GitLab - Repository visibility to Public

Back


Id	8b291c3d-90ba-4ebf-af2c-0283192d430e
Rulename	GitLab - Repository visibility to Public
Description	This query leverages GitLab Audit Logs. A repository in GitLab changed visibility from Private or Internal to Public which could indicate compromise, error or misconfiguration leading to exposing the repository to the public.
Severity	Medium
Tactics	Persistence DefenseEvasion CredentialAccess
Techniques	T1556
Required data connectors	SyslogAma
Kind	Scheduled
Query frequency	1h
Query period	1d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/GitLab/Analytic Rules/GitLab_RepoVisibilityChange.yaml
Version	1.0.1
Arm template	8b291c3d-90ba-4ebf-af2c-0283192d430e.json

KQL

GitLabAudit
| where SourceVisibility != "Public" and ChangeType == "visibility" and TargetVisibility == "Public"
| project TimeGenerated, EventTime, IPAddress, AuthorName, ChangeType, TargetType, SourceVisibility,  TargetVisibility, EntityName

YAML

status: Available
id: 8b291c3d-90ba-4ebf-af2c-0283192d430e
query: |
  GitLabAudit
  | where SourceVisibility != "Public" and ChangeType == "visibility" and TargetVisibility == "Public"
  | project TimeGenerated, EventTime, IPAddress, AuthorName, ChangeType, TargetType, SourceVisibility,  TargetVisibility, EntityName  
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/GitLab/Analytic Rules/GitLab_RepoVisibilityChange.yaml
description: |
    'This query leverages GitLab Audit Logs. A repository in GitLab changed visibility from Private or Internal to Public which could indicate compromise, error or misconfiguration leading to exposing the repository to the public.'
name: GitLab - Repository visibility to Public
relevantTechniques:
- T1556
entityMappings:
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: IPAddress
- entityType: Account
  fieldMappings:
  - identifier: FullName
    columnName: AuthorName
- entityType: URL
  fieldMappings:
  - identifier: Url
    columnName: EntityName
triggerThreshold: 0
severity: Medium
requiredDataConnectors:
- dataTypes:
  - Syslog
  connectorId: SyslogAma
queryFrequency: 1h
queryPeriod: 1d
version: 1.0.1
kind: Scheduled
tactics:
- Persistence
- DefenseEvasion
- CredentialAccess
triggerOperator: gt

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/8b291c3d-90ba-4ebf-af2c-0283192d430e')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/8b291c3d-90ba-4ebf-af2c-0283192d430e')]",
      "properties": {
        "alertRuleTemplateName": "8b291c3d-90ba-4ebf-af2c-0283192d430e",
        "customDetails": null,
        "description": "'This query leverages GitLab Audit Logs. A repository in GitLab changed visibility from Private or Internal to Public which could indicate compromise, error or misconfiguration leading to exposing the repository to the public.'\n",
        "displayName": "GitLab - Repository visibility to Public",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "columnName": "IPAddress",
                "identifier": "Address"
              }
            ]
          },
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "AuthorName",
                "identifier": "FullName"
              }
            ]
          },
          {
            "entityType": "URL",
            "fieldMappings": [
              {
                "columnName": "EntityName",
                "identifier": "Url"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/GitLab/Analytic Rules/GitLab_RepoVisibilityChange.yaml",
        "query": "GitLabAudit\n| where SourceVisibility != \"Public\" and ChangeType == \"visibility\" and TargetVisibility == \"Public\"\n| project TimeGenerated, EventTime, IPAddress, AuthorName, ChangeType, TargetType, SourceVisibility,  TargetVisibility, EntityName\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "P1D",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "CredentialAccess",
          "DefenseEvasion",
          "Persistence"
        ],
        "techniques": [
          "T1556"
        ],
        "templateVersion": "1.0.1",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}