Correlation Rule
Medium
✕
Gitlab - User Permission Changed
User''s permissions have changed from Guest to Owner
- Module:
- Platform Analytics
- Data source:
- gitlab_gitlab_raw
- Category:
- Privilege Escalation
- Content pack:
- GitLab
- Execution:
- SCHEDULED
- Search window:
- 10 minutes
XQL query:
datamodel dataset = gitlab_gitlab_raw | fields _time ,xdm.event.id ,xdm.source.user.identifier ,xdm.target.resource.id ,xdm.target.resource.type ,xdm.source.user.username ,xdm.target.resource.sub_type ,xdm.target.resource.name ,xdm.event.description ,xdm.source.ipv4 ,xdm.target.resource_before.value ,xdm.target.resource.value ,xdm.event.operation ,xdm.event.type ,xdm.event.operation_sub_type | filter xdm.event.operation = "change_access_level" and xdm.target.resource_before.value = "Guest" and xdm.target.resource.value = "Owner"