Event Types

In RESOURCES > Event Types, enter "GitLab" in the main content panel Search... field to see the events associated with this device.

Rules

No defined rules.

Reports

In RESOURCES > Reports, enter "GitLab" in the main content panel Search... field to see the reports associated with this device.

Syslog Integration

In FortiSIEM 7.x, there are two methods to send GitLab syslogs. Of the two methods, Fortinet recommends sending syslog via rsyslog forwarding.

• Syslog via Rsyslog Forwarding
• Syslog via GitLab remote_syslog

Syslog via Rsyslog Forwarding

To use rsyslog to collect and send GitLab logs via syslog, take the following steps:
Note: For detailed information on GitLab logs, see https://docs.gitlab.com/ee/administration/logs/.

1. Locate where your GitLab installation is writing log files, such as error or access logs. The typical location is provided here:

   /var/log/gitlab/gitlab-rails/

   /home/git/gitlab/log/

2. Locate the rsyslog.conf file on your GitLab server. The typical location is provided here:

   /etc/rsyslog.conf

3. Add the imfile module to your rsyslog.conf file in the modules section.

   module(load="imfile" PollingInterval="10")

4. Insert the following lines for GitLab logs in your rsyslog.conf file.

   input(type="imfile" File="/path/to/application_json.log"
   Tag=" GitLab_Application:"
   Severity="info"
   Facility="local6")
   

   Notes:
   

   • The Tag= line is critical as this string is matched in the FortiSIEM parser, do NOT modify it from the example above.

   • The Tag= line is case sensitive.

   • In addition to application_json.log in this step, you can also add the following suggested log files

     • production_json.log
     • api_json.log
     • git_json.log
     • Integrations_json.log
     • audit_json.log
     • gitlab-shell.log
     • auth_json.log
     • exceptions_json.log
       

     by inserting the following lines for each additional log you wish to add.
     

     input(type="imfile" File="/path/to/<suggested_log>"
     

     Tag=" <log type>:"

     Example: To add git_json.log, you would make the following changes:

     input(type="imfile" File="/path/to/git_json.log"

     Tag=" GitLab_GitRepo:"
     

5. Place the following in the rules section in your rsyslog.conf file.

   local6.* @<FortiSIEM collector IP or hostname>:514
   

   Note: Replace <FortiSIEM collector IP or hostname> with the IP address or hostname of your actual FortiSIEM collector.
   

6. Restart rsyslog by running the following command.

   systemctl restart rsyslog

7. Confirm that logs are arriving. Ensure that your firewall(s) allow UDP 514 inbound to target IP.

Example Log

<13>Feb 21 13:07:48 gitlab-test.example.com GitLab_Application: {"severity":"INFO","time":"2024-02-21T21:07:48.922Z","correlation_id":"01HQ6QXZPDZARVY2F2TJCHNJC1","meta.caller_id":"PipelineProcessWorker","meta.remote_ip":"192.0.2.0","meta.feature_category":"continuous_integration","meta.root_namespace":"devops","meta.client_id":"client/1122","meta.root_caller_id":"POST /api/:version/jobs/request","message":"Enqueuing hooks for Pipeline 772217: running","class":"Ci::Pipeline","pipeline_id":772217,"project_id":2642,"pipeline_status":"running"}

How It Works: The bolded section in the example log matches the Tag= definition in the rsyslog.conf file. This unique string is matched in the FortiSIEM GitLabLogParser.

Syslog via GitLab remote_syslog

Configure GitLab to send syslog to FortiSIEM via UDP on port 514. See here for details.

FortiSIEM will automatically detect GitHLab log patterns and parse the logs. Currently, the following log files are parsed: api_json.log, application.log, gitaly, gitlab-monitor, gitlab-shell.log, gitlab-workhorse.log, gitlab_access.log,production.log, production_json.log, Prometheus, Redis, remote-syslog, sidekiq, sidekiq_exporter.log, unicorn_stderr.log.

Currently, over 134 GitLab event types are parsed. To see the event types:

1. Login to FortiSIEM.
2. Go to RESOURCES > Event Types.
3. Search for "GitLab".

Use cases covered via syslog:

• Failed and Successful Login
• Git command execution
• Git API requests

To test for received GitLab events received via syslog:

1. Login to FortiSIEM.
2. Go to ANALYTICS.
3. Click the Edit Filters and Time Range... field:
   1. Choose the Event Attribute option.
   2. Create the Search condition
      Attribute: Event Type
      Operator: CONTAIN
      Value: GitLab
   3. Change Time Range to be Last 1 Hour
   4. Click Apply & Run.
4. See the GitLab events on the GUI.

FortiSIEM can also pull logs from GitLab using GitLab API.

Currently, over 134 GitLab event types are parsed. To see the event types:

1. Login to FortiSIEM.
2. Go to RESOURCES > Event Types.
3. Search for "GitLab".

Use cases covered via API:

• Code commit – note that the current API does not capture committed files.
• Changes to Projects, Branches, Tag, DiscussionNoted, Tag, Issues, Snippets, Repositories etc
• User created, deleted, modified

For more details, see here.

Create a personal access token to be used for FortiSIEM communication.

1. Login to your GitLab account.
2. Go to your Profile settings.
3. Go to Access tokens.
4. Choose a name and optionally an expiry date for the token.
5. Choose the desired scopes: api is required.
6. Click Create Personal Access Token. Save the personal access token in your local system. Note that once you leave or refresh the page, you won't be able to access it again.

For more details, see here.