Gitlab - User Permission Changed
Alert for change in user''s permissions change from Guest to Owner.
GitLab MEDIUM PRIVILEGE_ESCALATION
Details
| ID | 73ffe0c0-d4ef-498b-b740-e461cf4e498b |
|---|---|
| From Version | 6.10.0 |
| Execution Mode | SCHEDULED |
| Crontab | */10 * * * * |
| Search Window | 10 minutes |
| Dataset | alerts |
XQL Query
datamodel dataset = gitlab_gitlab_raw | fields _time ,xdm.event.id ,xdm.source.user.identifier ,xdm.target.resource.id ,xdm.target.resource.type ,xdm.source.user.username ,xdm.target.resource.sub_type ,xdm.target.resource.name ,xdm.event.description ,xdm.source.ipv4 ,xdm.target.resource_before.value ,xdm.target.resource.value ,xdm.event.operation ,xdm.event.type ,xdm.event.operation_sub_type | filter xdm.event.operation = "change_access_level" and xdm.target.resource_before.value = "Guest" and xdm.target.resource.value = "Owner"
Investigation Query
datamodel dataset = gitlab_gitlab_raw | fields _time ,xdm.event.id ,xdm.source.user.identifier ,xdm.target.resource.id ,xdm.target.resource.type ,xdm.source.user.username ,xdm.target.resource.sub_type ,xdm.target.resource.name ,xdm.event.description ,xdm.source.ipv4 ,xdm.target.resource_before.value ,xdm.target.resource.value ,xdm.event.operation ,xdm.event.type ,xdm.event.operation_sub_type | filter xdm.event.operation = "change_access_level" and xdm.target.resource_before.value = "Guest" and xdm.target.resource.value = "Owner"