Comment by samcheng

I used here:

https://github.com/organizations/<ORG_NAME>/settings/audit-l...

... but the real question is what would malicious activity look like, exactly?