Gitlab - User Permission Changed

Alert for change in user''s permissions change from Guest to Owner.

GitLab MEDIUM PRIVILEGE_ESCALATION

Details

ID73ffe0c0-d4ef-498b-b740-e461cf4e498b
From Version6.10.0
Execution ModeSCHEDULED
Crontab*/10 * * * *
Search Window10 minutes
Datasetalerts

XQL Query

datamodel dataset = gitlab_gitlab_raw 
| fields _time
,xdm.event.id 
,xdm.source.user.identifier 
,xdm.target.resource.id 
,xdm.target.resource.type 
,xdm.source.user.username 
,xdm.target.resource.sub_type 
,xdm.target.resource.name 
,xdm.event.description 
,xdm.source.ipv4 
,xdm.target.resource_before.value 
,xdm.target.resource.value 
,xdm.event.operation 
,xdm.event.type 
,xdm.event.operation_sub_type 
| filter xdm.event.operation = "change_access_level" and xdm.target.resource_before.value = "Guest" and xdm.target.resource.value = "Owner"

Investigation Query

datamodel dataset = gitlab_gitlab_raw 
| fields _time
,xdm.event.id 
,xdm.source.user.identifier 
,xdm.target.resource.id 
,xdm.target.resource.type 
,xdm.source.user.username 
,xdm.target.resource.sub_type 
,xdm.target.resource.name 
,xdm.event.description 
,xdm.source.ipv4 
,xdm.target.resource_before.value 
,xdm.target.resource.value 
,xdm.event.operation 
,xdm.event.type 
,xdm.event.operation_sub_type 
| filter xdm.event.operation = "change_access_level" and xdm.target.resource_before.value = "Guest" and xdm.target.resource.value = "Owner"