// List of allow-listed domains
let allowedDomain = pack_array("mydomain.com");
GitLabAudit
| where AddAction == "user"
| project AuthorName, IPAddress, User = EntityName
| join (GitLabApp
| where UserAdded == 1
| parse kind=regex Message with "User \"" User "\"" EmailAddress " was created"
| project tostring(User), EmailAddress = substring(EmailAddress,2,strlen(EmailAddress)-3)) on User
| project AuthorName, IPAddress, User, EmailAddress, DomainName = tostring(extract("@(.*)$", 1, EmailAddress))
| where allowedDomain !contains DomainName
queryPeriod: 1d
query: |
// List of allow-listed domains
let allowedDomain = pack_array("mydomain.com");
GitLabAudit
| where AddAction == "user"
| project AuthorName, IPAddress, User = EntityName
| join (GitLabApp
| where UserAdded == 1
| parse kind=regex Message with "User \"" User "\"" EmailAddress " was created"
| project tostring(User), EmailAddress = substring(EmailAddress,2,strlen(EmailAddress)-3)) on User
| project AuthorName, IPAddress, User, EmailAddress, DomainName = tostring(extract("@(.*)$", 1, EmailAddress))
| where allowedDomain !contains DomainName
name: GitLab - External User Added to GitLab
entityMappings:
- fieldMappings:
- columnName: IPAddress
identifier: Address
entityType: IP
- fieldMappings:
- columnName: User
identifier: FullName
entityType: Account
- fieldMappings:
- columnName: AuthorName
identifier: FullName
entityType: Account
- fieldMappings:
- columnName: DomainName
identifier: DomainName
entityType: DNS
queryFrequency: 1h
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/GitLab/Analytic Rules/GitLab_ExternalUser.yaml
requiredDataConnectors:
- connectorId: SyslogAma
dataTypes:
- Syslog
description: |
'This queries GitLab Application logs to list external user accounts (i.e.: account not in allow-listed domains) which have been added to GitLab users.'
kind: Scheduled
version: 1.0.1
status: Available
severity: Medium
relevantTechniques:
- T1136
triggerOperator: gt
triggerThreshold: 0
tactics:
- Persistence
id: c1544d8f-cbbd-4e35-8d32-5b9312279833
