// List of allow-listed domains
let allowedDomain = pack_array("mydomain.com");
GitLabAudit
| where AddAction == "user"
| project AuthorName, IPAddress, User = EntityName
| join (GitLabApp
| where UserAdded == 1
| parse kind=regex Message with "User \"" User "\"" EmailAddress " was created"
| project tostring(User), EmailAddress = substring(EmailAddress,2,strlen(EmailAddress)-3)) on User
| project AuthorName, IPAddress, User, EmailAddress, DomainName = tostring(extract("@(.*)$", 1, EmailAddress))
| where allowedDomain !contains DomainName
status: Available
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/GitLab/Analytic Rules/GitLab_ExternalUser.yaml
query: |
// List of allow-listed domains
let allowedDomain = pack_array("mydomain.com");
GitLabAudit
| where AddAction == "user"
| project AuthorName, IPAddress, User = EntityName
| join (GitLabApp
| where UserAdded == 1
| parse kind=regex Message with "User \"" User "\"" EmailAddress " was created"
| project tostring(User), EmailAddress = substring(EmailAddress,2,strlen(EmailAddress)-3)) on User
| project AuthorName, IPAddress, User, EmailAddress, DomainName = tostring(extract("@(.*)$", 1, EmailAddress))
| where allowedDomain !contains DomainName
requiredDataConnectors:
- dataTypes:
- Syslog
connectorId: SyslogAma
tactics:
- Persistence
name: GitLab - External User Added to GitLab
relevantTechniques:
- T1136
severity: Medium
entityMappings:
- fieldMappings:
- identifier: Address
columnName: IPAddress
entityType: IP
- fieldMappings:
- identifier: FullName
columnName: User
entityType: Account
- fieldMappings:
- identifier: FullName
columnName: AuthorName
entityType: Account
- fieldMappings:
- identifier: DomainName
columnName: DomainName
entityType: DNS
kind: Scheduled
queryFrequency: 1h
description: |
'This queries GitLab Application logs to list external user accounts (i.e.: account not in allow-listed domains) which have been added to GitLab users.'
triggerThreshold: 0
triggerOperator: gt
version: 1.0.1
queryPeriod: 1d
id: c1544d8f-cbbd-4e35-8d32-5b9312279833
