json ^audit_json$ ^authenticated_with_password$ GitLab successful password authentication: $(meta.user) from $(meta.remote_ip), correlation $(correlation_id) authentication_success, json ^audit_json$ ^authenticated_with_oauth$ GitLab successful OAuth authentication: $(meta.user) from $(meta.remote_ip), correlation $(correlation_id) authentication_success,oauth, json ^audit_json$ ^authenticated_with_two_factor$ GitLab successful two-factor authentication: $(meta.user) from $(meta.remote_ip), correlation $(correlation_id) authentication_success,mfa, json ^audit_json$ ^user_access_locked$ GitLab account locked - excessive failed login attempts: $(meta.user) from $(meta.remote_ip), correlation $(correlation_id) T1110 account_lockout,brute_force,authentication_failed, json ^audit_json$ (?i)(personal_access_token|ssh_key|password_changed|email_changed|two_factor_(enabled|disabled)|member_(added|removed)|project_created|user_(created|blocked|unblocked)) GitLab security-sensitive audit event: $(event_name), actor $(meta.user), target $(target_details) account_changed,gitlab_audit, json ^production_json$ ^UserSettings::PersonalAccessTokensController$ ^create$ ^POST$ ^200$ GitLab personal access token created by $(meta.user) from $(remote_ip), correlation $(correlation_id) credential_created,personal_access_token, json ^production_json$ ^UserSettings::SshKeysController$ ^(create|destroy|revoke)$ GitLab SSH key changed by $(meta.user) from $(remote_ip): $(action), correlation $(correlation_id) T1098.004 account_manipulation,ssh_key, json ^production_json$ ^Profiles::TwoFactorAuthsController$ ^(POST|PUT|PATCH|DELETE)$ GitLab two-factor authentication setting changed by $(meta.user) from $(remote_ip): $(action) T1098 account_manipulation,mfa, json ^production_json$ ^(Profiles::|UserSettings::).*(Passwords|Emails|Accounts|Profiles|Preferences) ^(POST|PUT|PATCH|DELETE)$ GitLab account/profile security setting changed by $(meta.user) from $(remote_ip): $(controller)#$(action) account_manipulation, json ^production_json$ ^ProjectsController$ ^create$ ^POST$ GitLab project created by $(meta.user) from $(remote_ip): $(path) project_created,resource_creation, json ^production_json$ ^Projects::Settings::.*Controller$ ^(POST|PUT|PATCH|DELETE)$ GitLab project security/repository setting changed by $(meta.user): $(controller)#$(action), $(path) project_configuration,configuration_changed, json ^production_json$ ^(Projects|Groups)::.*(Members|Hooks|DeployKeys|AccessTokens|ProtectedBranches|ProtectedTags)Controller$ ^(POST|PUT|PATCH|DELETE)$ GitLab membership/access/hook control changed by $(meta.user): $(controller)#$(action), $(path) T1098 access_control,configuration_changed, json ^production_json$ ^Projects::(Branches|Tags)Controller$ ^(create|destroy)$ GitLab branch/tag changed by $(meta.user) from $(remote_ip): $(action), $(path) repository_changed, json ^production_json$ ^Repositories::GitHttpController$ ^git_receive_pack$ ^200$ GitLab Git-over-HTTP push by $(meta.user) from $(remote_ip): $(path) git_push,repository_changed, 110064 meta.user GitLab unusually frequent Git-over-HTTP pushes by $(meta.user) git_push,anomaly, json ^production_json$ ^Projects::.*(Exports|Repositories)Controller$ ^(create|download|archive)$ GitLab repository export/archive activity by $(meta.user) from $(remote_ip): $(path) T1213.003 data_access,repository_export, json ^sidekiq$ ^ProjectsController#destroy$ ^start$ GitLab project deleted (web UI) by $(meta.user): $(meta.project) T1485 project_deleted,resource_deletion, json ^(production_json|api_json)$ -deletion_scheduled- GitLab activity on project pending deletion by $(meta.user) from $(remote_ip): $(meta.project) pending_deletion_access,data_access, json ^sidekiq$ ^GroupsController#destroy$ ^start$ GitLab group deleted (web UI) by $(meta.user): $(meta.project) T1485 project_deleted,resource_deletion, json ^api_json$ ^/api/:version/projects$ ^POST$ ^20[0-9]$ GitLab project created via API by $(meta.user) from $(remote_ip) project_created,resource_creation, json ^api_json$ ^/api/:version/projects/:id$ ^DELETE$ ^20[0-9]$ GitLab project deleted via API by $(meta.user) from $(remote_ip): $(meta.project) T1485 project_deleted,resource_deletion, json ^api_json$ ^/api/:version/projects/:id/fork$ ^POST$ ^20[0-9]$ GitLab project forked via API by $(meta.user) from $(remote_ip): $(meta.project) T1537 project_forked,data_access, json ^production_json$ ^/admin(?:/|$) GitLab Admin Area accessed by $(meta.user) from $(remote_ip): $(method) $(path) admin_access, 110070 ^(POST|PUT|PATCH|DELETE)$ GitLab administrative change by $(meta.user) from $(remote_ip): $(method) $(path) admin_action,configuration_changed,