Ingesting audit logs from Gitlab

Hi Keso,

If the gitlab instance is running on GKE then I think the first steps might be to determine how GKE logs are currently configured to flow. If they're already routing to a bucket then you should be able to provide that path to the feed configuration in your screenshots. If not, it may be necessary to have the routing configure for that bucket destination.

I've included the relevant docs below.

https://cloud.google.com/kubernetes-engine/docs/concepts/about-logshttps://cloud.google.com/logging/docs/routing/overviewhttps://docs.gitlab.com/ee/user/infrastructure/clusters/connect/new_gke_cluster.html

Hi, the logs from gitlab are sent to cloud logging where it is possible to see them. But when I try to configure the filter in Chronicle to ingest them, there is an error that says "The provided filter can potentially allow unsupported log types." so it is not possible to consume in that way. By design the GKE logs end up in Cloud Logging. How could the logs be ingested in that scenario? 

Hi Keso, one things you could check for that issue are:

1. it should be logName instead of log_name in the filter expression - and there should be a field logName in the log itself in logs explorer.
2. Check that the regex works for the logName

Alternatively, you're there are other workaround options to get that data to SecOps such as:
Pub/Sub: You can set up a Pub/Sub topic to receive the filtered GitLab logs from Cloud Logging. Then, configure Chronicle to subscribe to that topic and ingest the logs.

Hope this helps.

Hey, yes, we are using           logname = "<name>"      in the filter and the log itself contains the logName field and it matches the <name>.

When checking the filter in cloud logging we are able to see the logs that we want to be ingested by Chronicle. But, when configuring the ingestion filter it fails with the error  "The provided filter can potentially allow unsupported log types."

By design we are sending the logs to a log bucket, so the logs are already there and we would like to use the ingestion filter to ingest them. Please, how could that be done?