# GitLab / Wazuh draft reference files

These six XML files and two dashboard exports accompany the draft article at `/posts/gitlab-authentication-wazuh/`. They are reference material for technical review, not a validated deployment bundle.

## Changes from the supplied files

- Removed original XML comments, which included identifying account, address, host, project and incident details. Relevant technical caveats are retained below and in the article.
- Removed the organization prefix from the decoder, authentication and OAuth filenames.
- Replaced the original organization-specific OAuth domain regex with `example\.(?:org|net)`. This changes the example allowlist; replace it for your environment only after reviewing the signal's limitations.
- Normalized line endings and blank lines. All other XML elements, rule IDs, expressions and thresholds are unchanged.

## Dependencies and open issues

The decoder belongs under the Wazuh manager's decoder directory, the rule groups under its rules directory, and the `localfile` fragments inside the GitLab agent's existing `ossec_config` element. Do not replace the agent configuration with the fragments. Check local rule-ID conflicts before any test deployment.

- `110102` and `110103` use dynamic-field correlation on static `dstuser`; review the dedicated user operators and validate full sequences before use.
- Their parent `110106` requires the `gitlab-failed-login` decoder and a live, collected plain-text `application.log`. Availability was unresolved in the supplied notes.
- JSON rules gated on `integration.log_type` require the corresponding collection labels. Raw manual replay does not automatically reproduce those labels.
- `110092`, `110093` and `110094` depend on `110064` in `gitlab_rules_10_json.xml`; the repository file is not standalone.
- `110013`, `110069`, `110072`–`110074`, and SSH rules `110080`–`110082` were explicitly marked as needing real-event validation.
- `110105` matches a redirect, not independently confirmed completed authentication. Several lifecycle rules likewise match requests or job starts rather than completion.
- `110041` searches raw callback parameters, not a validated ID-token claim. Its example domains are placeholders. Review missing parameters, duplicate parameters, JSON shape variations and the severity/mapping.
- The repository rules include broad anomaly heuristics. Large transfers, automation pushes and public browsing may be legitimate. A changed source IP does not establish impossible travel.
- Rules can overlap on the same event. Replay them together to check precedence, correlation inputs and counts. Several background jobs may correspond to a single deletion request.
- Collection uses `only-future-events=yes`; generate new test activity after enabling it. Source availability and formats vary by installation.

No Wazuh manager runtime tests were performed when preparing these reference copies. XML well-formedness is not Wazuh behavioural validation. Two dashboard exports are bundled. No PDF, screenshot, live event results or validation transcript is bundled.

Hugo copies static resources even when the article is a draft. These files are deliberately sanitized for that reason.

## Dashboard exports added after the initial draft

Both uploaded NDJSON files were inspected, including nested visualization state, search queries, aggregations, columns, references and panel layouts. Sanitization replaces organization domains with `example.org` / `example.net` and the identifying subnet with `192.0.2.0/24`. The activity filename drops the upload suffix `(1)`. Everything else, including dated captions and export trailers, is preserved.

- Authentication: 20 saved objects (14 visualizations, 5 searches, 1 dashboard), 19 panel placements. The trailer reports 19 objects.
- Repository activity: 40 saved objects (35 visualizations, 4 searches, 1 dashboard), 39 panel placements. The trailer reports 39 objects.
- Every panel reference resolves within its export. Both refer to the external `wazuh-alerts-*` index-pattern ID, whose definition is absent. Use an existing compatible data view or remap the reference when importing; verify its timestamp and field mappings.
- Both restore the last seven days with refresh paused and no dashboard-level filter. No authentication time-series visualization or automated failure-to-success join is present.
- Queries, aggregations and columns are not repaired in these copies. The draft identifies HTTP/SSH field mismatches, inconsistent/unscoped anomaly queues, session-counting and spraying-cardinality limitations, and an OAuth caption describing an older rule implementation.
- The authentication caption reports zero matches from the account-based path in its dated review. This is historical narrative in the export, not a new runtime test.
- Some repository captions draw stronger conclusions than their queries establish (for example, missing SSH events proving collection is off, overnight reads proving CI, or shared addresses proving benign egress). Treat these as hypotheses requiring supporting telemetry.

Import was not tested against a live Wazuh dashboard. Existing saved objects use the same IDs; review import conflicts before choosing overwrite. The source export trailers are preserved despite the count discrepancies noted above.