Blog Post

Microsoft Sentinel Blog
4 MIN READ

Enhancing Security Monitoring: Integrating GitLab Cloud Edition with Microsoft Sentinel

VipulDabhi's avatar
VipulDabhi
Icon for Microsoft rankMicrosoft
Aug 05, 2024
Purpose of this Blog: The absence of a dedicated connector for GitLab Cloud Edition in Microsoft Sentinel presents a challenge for complete security surveillance for firms using GitLab. To overco...
Updated Aug 02, 2024
Version 1.0
data collection
deployment and configuration
microsoft sentinel
playbooks
solutions
arwadhahri's avatar
arwadhahri
Copper Contributor
Oct 09, 2024

hi, 

In GitLab configuration, which role and scopes should be selected.

 

  • SebastianDDX's avatar
    SebastianDDX
    Copper Contributor
    Mar 04, 2025

    Hello, did you find out and can share? I suppose an Admin Account needs to create a PAT with at least read_api?

    • VipulDabhi's avatar
      VipulDabhi
      Icon for Microsoft rankMicrosoft
      Mar 04, 2025

      You can try creating your own demo/trial account to test this functionality, trial account does have some restrictions.

      • SebastianDDX's avatar
        SebastianDDX
        Copper Contributor
        Mar 04, 2025

        Gitlab says "To retrieve audit events using the API, you must https://docs.gitlab.com/api/rest/authentication/ as an Administrator." (https://docs.gitlab.com/api/audit_events/) So I was wondering what kind of permissions that PAT requires.
        Obviously, I do not want to create an API Token with Admin access when I just want to ingest audit logs to Sentinel. This is supposed to be for a Premium Tier Gitlab instance.