Overview

The GitLab integration polls the GitLab Audit Events API and ingests:

  • Group, project, and user audit events
  • Merge request approvals, push, and protected branch changes
  • CI/CD pipeline triggers and runner registration
  • Personal, project, and group access token activity
  • Permission and role modifications

Works with gitlab.com and self-hosted GitLab (Premium and Ultimate tiers).

Prerequisites

  • A GitLab Premium or Ultimate subscription (audit events API requirement).
  • For groups/instances: an account with Owner (group) or Administrator (self-hosted) permissions.
  • The GitLab base URL — https://gitlab.com for SaaS, or your self-hosted URL.

Step 1: Create a Personal Access Token in GitLab

  1. Sign in to GitLab.
  2. Click your avatar → Edit profile → Access tokens.
  3. Click Add new token.
  4. Name it atatus-siem, set an expiry, and select the following scopes:
    • read_api
    • read_audit_log (where available)
  5. Click Create personal access token and copy the value (starts with glpat-).

Note: Instance-level audit events on self-hosted GitLab require an Administrator account; group-level events require Owner of the group.

Step 2: Connect GitLab in Atatus

  1. In Atatus, go to Security → Cloud SIEM → Integrations.
  2. Locate the GitLab card and click Connect.
  3. Fill in the form:
Field Description Example
Personal Access Token The PAT created in Step 1. glpat-xxxxxxxxxxxxxxxxxxxx
GitLab URL Base URL of your GitLab instance. https://gitlab.com
Poll Interval (minutes) How often to fetch new events. 5
Enabled Turn collection on. true
  1. Click Connect.

Verification

  • The GitLab card shows Configured.
  • Audit events appear in Security → Cloud SIEM → Audit Logs → Events with source gitlab.