GitLab - Repository visibility to Public

Back


Id	8b291c3d-90ba-4ebf-af2c-0283192d430e
Rulename	GitLab - Repository visibility to Public
Description	This query leverages GitLab Audit Logs. A repository in GitLab changed visibility from Private or Internal to Public which could indicate compromise, error or misconfiguration leading to exposing the repository to the public.
Severity	Medium
Tactics	Persistence DefenseEvasion CredentialAccess
Techniques	T1556
Required data connectors	SyslogAma
Kind	Scheduled
Query frequency	1h
Query period	1d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/GitLab/Analytic Rules/GitLab_RepoVisibilityChange.yaml
Version	1.0.1
Arm template	8b291c3d-90ba-4ebf-af2c-0283192d430e.json

KQL

GitLabAudit
| where SourceVisibility != "Public" and ChangeType == "visibility" and TargetVisibility == "Public"
| project TimeGenerated, EventTime, IPAddress, AuthorName, ChangeType, TargetType, SourceVisibility,  TargetVisibility, EntityName

YAML

triggerThreshold: 0
relevantTechniques:
- T1556
query: |
  GitLabAudit
  | where SourceVisibility != "Public" and ChangeType == "visibility" and TargetVisibility == "Public"
  | project TimeGenerated, EventTime, IPAddress, AuthorName, ChangeType, TargetType, SourceVisibility,  TargetVisibility, EntityName  
triggerOperator: gt
entityMappings:
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: IPAddress
- entityType: Account
  fieldMappings:
  - identifier: FullName
    columnName: AuthorName
- entityType: URL
  fieldMappings:
  - identifier: Url
    columnName: EntityName
name: GitLab - Repository visibility to Public
version: 1.0.1
severity: Medium
requiredDataConnectors:
- connectorId: SyslogAma
  dataTypes:
  - Syslog
description: |
    'This query leverages GitLab Audit Logs. A repository in GitLab changed visibility from Private or Internal to Public which could indicate compromise, error or misconfiguration leading to exposing the repository to the public.'
queryPeriod: 1d
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/GitLab/Analytic Rules/GitLab_RepoVisibilityChange.yaml
kind: Scheduled
queryFrequency: 1h
tactics:
- Persistence
- DefenseEvasion
- CredentialAccess
status: Available
id: 8b291c3d-90ba-4ebf-af2c-0283192d430e

ARM