json ^SessionsController$ ^/users/sign_in$ ^POST$ ^new$ ^200$ GitLab failed web sign-in from $(remote_ip), UA $(ua), correlation $(correlation_id) T1110 authentication_failed,credential_access, json ^SessionsController$ ^/users/sign_in$ ^POST$ ^302$ GitLab successful web sign-in from $(remote_ip), correlation $(correlation_id) authentication_success, 110100 remote_ip GitLab: repeated failed web sign-ins from $(remote_ip) T1110.001 brute_force,authentication_failures, gitlab-failed-login GitLab failed login for account $(dstuser) from $(srcip) T1110 authentication_failed,credential_access, 110106 dstuser GitLab: repeated failed logins against account $(dstuser) T1110.001 brute_force,account_lockout_risk, 110106 dstuser GitLab: one source IP attempted multiple accounts: $(srcip) T1110.003 password_spraying,