GitLab - TI - Connection from Malicious IP

This query correlates Threat Intelligence data from Microsoft Sentinel with GitLab NGINX Access Logs (available in GitLab CE as well) to identify access from potentially TI-flagged IPs.

Detection logic

Detection requirements

Platform: Containers ESXi IaaS Identity Provider Linux macOS Network Devices Office Suite SaaS Windows
The rule states no platform. This is derived from the ATT&CK technique it maps to.
Log source product: syslogama threatintelligence threatintelligencetaxii
Log source service: syslog threatintelligenceindicator

Detection rules

GitLab - TI - Connection from Malicious IP

Detection logic

Detection requirements

MITRE ATT&CK mappings

From the source

Licence

Authorship

Detection rules