Gitlab S3 Streaming Audit Logs

GitLab Audit Logs provide a detailed record of events and actions taken within a GitLab instance, helping organizations track changes for security and compliance purposes. The logs capture information such as user activity (e.g., login attempts, project changes, and group modifications), timestamps, and the specific actions performed, enabling administrators to monitor user behavior, investigate incidents, and ensure adherence to security policies.

Ingest Methods

Setup the ingestion of this source using one of the following guides.

• AWS S3 Bucket
• AWS S3 Bucket with Custom SQS
• Google Cloud Storage

arn:aws:sns:<REGION>:253602268883:runreveal_gitlab

Setup

Follow Gitlab’s docs on how to enable log streaming in your account. RunReveal does not currently support Gitlab HTTP destinations.

https://docs.gitlab.com/ee/user/compliance/audit_event_streaming.html

Schema

The following columns are exposed for this source. RunReveal applies schema normalization across all sources, ensuring uniform field names and data types for cross-source queries and reusable detection logic.