GitLab - Repository visibility to Public

Back


Id	8b291c3d-90ba-4ebf-af2c-0283192d430e
Rulename	GitLab - Repository visibility to Public
Description	This query leverages GitLab Audit Logs. A repository in GitLab changed visibility from Private or Internal to Public which could indicate compromise, error or misconfiguration leading to exposing the repository to the public.
Severity	Medium
Tactics	Persistence DefenseEvasion CredentialAccess
Techniques	T1556
Required data connectors	SyslogAma
Kind	Scheduled
Query frequency	1h
Query period	1d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/GitLab/Analytic Rules/GitLab_RepoVisibilityChange.yaml
Version	1.0.1
Arm template	8b291c3d-90ba-4ebf-af2c-0283192d430e.json

KQL

GitLabAudit
| where SourceVisibility != "Public" and ChangeType == "visibility" and TargetVisibility == "Public"
| project TimeGenerated, EventTime, IPAddress, AuthorName, ChangeType, TargetType, SourceVisibility,  TargetVisibility, EntityName

YAML

kind: Scheduled
triggerOperator: gt
queryFrequency: 1h
id: 8b291c3d-90ba-4ebf-af2c-0283192d430e
queryPeriod: 1d
relevantTechniques:
- T1556
entityMappings:
- entityType: IP
  fieldMappings:
  - columnName: IPAddress
    identifier: Address
- entityType: Account
  fieldMappings:
  - columnName: AuthorName
    identifier: FullName
- entityType: URL
  fieldMappings:
  - columnName: EntityName
    identifier: Url
query: |
  GitLabAudit
  | where SourceVisibility != "Public" and ChangeType == "visibility" and TargetVisibility == "Public"
  | project TimeGenerated, EventTime, IPAddress, AuthorName, ChangeType, TargetType, SourceVisibility,  TargetVisibility, EntityName  
name: GitLab - Repository visibility to Public
severity: Medium
tactics:
- Persistence
- DefenseEvasion
- CredentialAccess
requiredDataConnectors:
- connectorId: SyslogAma
  dataTypes:
  - Syslog
version: 1.0.1
status: Available
triggerThreshold: 0
description: |
    'This query leverages GitLab Audit Logs. A repository in GitLab changed visibility from Private or Internal to Public which could indicate compromise, error or misconfiguration leading to exposing the repository to the public.'
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/GitLab/Analytic Rules/GitLab_RepoVisibilityChange.yaml

ARM