json ^gitlab_shell$ ^git-receive-pack$ GitLab Git-over-SSH push: $(gl_project_path) by $(gl_username) from $(remote_ip) git_push,repository_changed,git_ssh, json ^gitlab_shell$ ^git-upload-pack$ GitLab Git-over-SSH fetch/clone: $(gl_project_path) by $(gl_username) from $(remote_ip) git_fetch,data_access,git_ssh, 110081 gl_username gl_project_path GitLab: $(gl_username) cloned/fetched many distinct repositories over SSH in a short window T1213.003 data_access,mass_clone,anomaly, json ^workhorse$ ^git_upload_pack$ ^\d{9,}$ GitLab large repository clone served to $(remote_ip): $(uri), $(written_bytes) bytes, agent $(user_agent) T1213.003 data_access,large_transfer, 110083 ^\d{10,}$ GitLab very large repository clone served to $(remote_ip): $(uri), $(written_bytes) bytes T1213.003 data_access,bulk_egress, 110083 remote_ip GitLab repeated large clones from a single source: $(remote_ip) T1213.003 data_access,bulk_egress,anomaly, 110083 uri remote_ip GitLab one repository cloned in volume from many sources: $(uri) data_access,mass_clone, json ^production_json$ /-/autocomplete/users\.json ^200$ ^ip/ GitLab anonymous project member-list read from $(remote_ip), project $(meta.project) anonymous_access,page_render_byproduct, json ^production_json$ ^Projects::(Blob|Raw|Tree|Blame|Commits|Refs)Controller$ ^ip/ GitLab anonymous repository-content read from $(remote_ip): $(controller), project $(meta.project) anonymous_access,content_read, 110088 meta.project remote_ip GitLab sustained anonymous crawl of project $(meta.project) from rotating sources T1595 scraping,resource_abuse, json ^production_json$ ^/api/graphql$ ^ip/ GitLab anonymous GraphQL query from $(remote_ip), project $(meta.project) anonymous_access, 110090 meta.project remote_ip GitLab high-volume anonymous GraphQL against project $(meta.project) from rotating sources T1595 scraping,resource_abuse, 110088 remote_ip GitLab sustained anonymous content crawl from a single source: $(remote_ip) T1595 scraping,resource_abuse, json ^production_json$ ^ip/ ^[1-9]\d*\. GitLab expensive anonymous request, project $(meta.project) from $(remote_ip): $(duration_s)s resource_abuse,performance, 110079 meta.project GitLab repeated expensive anonymous requests against project $(meta.project) resource_abuse,performance, 110064 meta.user meta.project GitLab: $(meta.user) pushed to several distinct repositories in a short window T1195 git_push,anomaly, 110064 meta.user remote_ip GitLab: $(meta.user) pushed from more than one source address in a short window T1078 git_push,impossible_travel_candidate,anomaly, 110064 (?i)gitlab-runner|go-git|python-requests|curl/|libgit2 GitLab push using an automation user agent by $(meta.user) from $(remote_ip): $(ua) T1195 git_push,automation_push,anomaly, json ^production_json$ ^Repositories::GitHttpController$ ^git_upload_pack$ ^200$ GitLab Git-over-HTTP fetch/clone by $(meta.user) from $(remote_ip): $(meta.project) git_fetch,data_access, json ^workhorse$ ^git_(upload|receive)_pack$ GitLab Git transfer via workhorse: $(route_id), $(uri), $(written_bytes) bytes out, $(read_bytes) bytes in git_transfer,volume_baseline,