Query: personal_access_token_granted

select
  tp_timestamp as timestamp,
action as operation,
user_programmatic_access_name as resource,
actor,
tp_source_ip as source_ip,
tp_id as source_id,
*
exclude (actor, timestamp)

from
  github_security_log
where
  action in ('personal_access_token.access_granted')
order by
  tp_timestamp desc;