GitLab

Support Added: FortiSIEM 7.2.0

Vendor Version Tested: Not Provided

Vendor: GitLab

Product Information: https://about.gitlab.com/platform/

Comprehensive AI-powered DevSecOps platform.

• Configuration

• Checking for Events

• Event Type

Configuration

• Prerequisite

• FortiSIEM Setup

• GitLab Setup

Prerequisite

Most applications using webhook push notifications do server TLS certificate validation, which means the target collector must be configured with a public CA signed TLS certificate.

See How to Set Up a FortiSIEM Collector with a Public SSL/TLS Certificate for configuration information.

FortiSIEM Setup

To configure webhook integration, you will need to take the following general steps.

• Create Credential

Create Credential

Take the following steps to configure a credential for FortiSIEM.

1. Login to FortiSIEM as an administrator.

2. Navigate to Admin > Setup > Credentials.

3. Under Step 1: Enter Credentials, click New.

4. In the Access Method Definition window, input the following:

   1. In the Name field, enter the name of the credential. This serves as the basis of the target endpoint created.

   2. From the Device Type drop-down list, select GitLab GitLab.

   3. From the Access Protocol drop-down list, select Webhook.

   4. In the Separator field, leave the default as "\n" to separate the payload. The "\n" is the newline linefeed and means that each line in the response is treated as a new log.

   5. In the Receiver FQDN field, enter the FQDN of the FortiSIEM node. This field expects the FQDN or IP address of the FortiSIEM collector that will be receiving the webhook traffic. This is used to help dynamically generate an endpoint configuration for you. This should ideally be the FQDN of the collector from the sending application's perspective. For example, if this is a SaaS application on the public internet, this will be a public FQDN, e.g. collector01.example.com.
      

   6. In the Reporting Host Name field, enter "GitLab.com". This field expects the source hostname of the sending application. It is used to uniquely identify the logs as it will be in the header of every log. You can use something like example.com if example.com was the vendor's domain.

   7. Endpoint is the dynamically generated webhook endpoint based on the receiver FQDN. This makes it easier to paste this URL as the target of your webhooks in the client application.

   8. From the Auth Type drop-down list, select Simple Secret. Simple Secret compares the secret with the value of header/ parameter in HTTP request directly.
      

   9. In the Shared Secret field, enter the shared secret.

   10. From the Auth Part drop-down list, select Header.

   11. In the Header Name field, enter "X-Gitlab-Token".

   12. Click Save and Deploy.

   13. Click Edit to return to the Webhook configuration you just saved. From the Endpoint row, copy the URL. This URL will be needed to configure webhook in GitLab Setup.
       

       
       

GitLab Setup

Reference Documentation: https://docs.gitlab.com/ee/user/project/integrations/webhooks.html

1. From your project or group, on the left sidebar, navigate to Settings > Webhooks.

2. Click Add new webhook.

3. In the URL field, enter/paste the URL of the webhook endpoint. You should have this information from your FortiSIEM configuration when you copied the URL from the Endpoint row.
   

   It will be in the following format:
   

   https://<FortiSIEM_Node_IP>/webhook/<FortiSIEM_Credential_NAME>

4. Check Show full URL.

5. In the Secret token field, enter the secret token to validate payloads. This secret token should be the same as the shared secret in your FortiSIEM configuration.

6. In the Trigger section, select the events that will trigger the webhook.

7. (Optional) Clear the Enable SSL verification checkbox to disable SSL verification.
   

   If you would like to leave SSL verification enabled, you must ensure the target FortiSIEM collector, or target device terminating the TLS connection is using a public CA signed TLS/SSL certificate.

   Note: If Enable SSL verification is enabled, ensure the collector is setup with a valid TLS certificate. See the Prerequisite for more information.
   

8. Click Add webhook.
   

Checking for Events

Events can be queried from the Analytics page, using gitlab- as part of a Raw Event Log search. Make sure GitLab Setup is completed before proceeding with your check for events.

1. Navigate to Analytics >Search.

2. Click Edit Filters and Time Range.....

3. In Filter By, select the Event Attribute tab.

4. Enter/select the following:
   Attribute = Raw Event Log, Operator = CONTAIN, Value = gitlab-

5. Click Apply & Run.

Event Type

[PH_DEV_MON_CUSTOM_JSON]:[reptVendor]=GitLab,[reptModel]=GitLab,[reptDevName]=Gitlab.com,[reptDevIpAddr]=192.0.20.1,[json]={"object_kind":"push","event_name":"push","before":"f6b6bc1d9fb2bb191c61e934031f10931e198088","after":"f6b6bc1d9fb2bb191c61e934031f10931e198088","ref":"refs/heads/main","ref_protected":true,"checkout_sha":"f6b6bc1d9fb2bb191c61e934031f10931e198088","message":null,"user_id":20685255,"user_name":"user1","user_username":"user1","user_email":null,"user_avatar":"https://secure.gravatar.com/avatar/b28999676eb9a776197e27504358c0bfce1d1ebf9771c550bd51a2fde1702833?s=80&d=identicon","project_id":56310484,"project":{"id":56310484,"name":"testProject2","description":null,"web_url":"https://gitlab.com/testgroup432113/testproject2","avatar_url":null,"git_ssh_url":"git@gitlab.com:testgroup432113/testproject2.git","git_http_url":"https://gitlab.com/testgroup432113/testproject2.git","namespace":"testGroup","visibility_level":20,"path_with_namespace":"testgroup432113/testproject2","default_branch":"main","ci_config_path":"","homepage":"https://gitlab.com/testgroup432113/testproject2","url":"git@gitlab.com:testgroup432113/testproject2.git","ssh_url":"git@gitlab.com:testgroup432113/testproject2.git","http_url":"https://gitlab.com/testgroup432113/testproject2.git"},"commits":[{"id":"f6b6bc1d9fb2bb191c61e934031f10931e198088","message":"Initial commit","title":"Initial commit","timestamp":"2024-03-28T22:44:51+00:00","url":"https://gitlab.com/testgroup432113/testproject2/-/commit/f6b6bc1d9fb2bb191c61e934031f10931e198088","author":{"name":"user1","email":"user1@abc.com"},"added":["README.md"],"modified":[],"removed":[]}],"total_commits_count":1,"push_options":{},"repository":{"name":"testProject2","url":"git@gitlab.com:testgroup432113/testproject2.git","description":null,"homepage":"https://gitlab.com/testgroup432113/testproject2","git_http_url":"https://gitlab.com/testgroup432113/testproject2.git","git_ssh_url":"git@gitlab.com:testgroup432113/testproject2.git","visibility_level":20}}