GitLab Compliance Group - Product, 9 Jan 2023

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Event type filters demo

Description

https://docs.gitlab.com/ee/administration/audit_event_streaming.html#event-type-filters

A

Hello, everyone I am harshima, and today we are going to do a quick demo on event type filters. This feature was introduced in Gate life 15.7 and is behind a feature flag which is disabled by default. So if you want to try this feature out, you will first have to enable this feature flag, and once this feature is enabled you can start adding filters on a destination. One thing to note here is: if the feature is enabled with no filters, the destination will receive all audit events.

A

So, let's begin in my group, I have already created these two external destinations for the first one we are going to create a filter and for the second one we are not going to create any filter and we will see how audit events are being received in these endpoints.

A

Let's begin by creating our audit event for this, I am going to download a project and in our endpoints we can see. We have received a post request containing the audit event payload, and for this event we have a event type repository download operation. So, let's create a filter for this event type for this we will open our graphql Explorer.

A

First I am going to query external audit event destinations and for this group issue, reproduce group we have two destination URLs configured and we don't have any event type filters here. So, let's create one for this. I am going to run this mutation, which takes destination ID, so I am going to copy this.

A

Paste it here and we want to create a filter for this event type so I'm going to copy this and paste it here.

A

So I have created a event, type filter, and let's refresh this page and here as you can see for the first destination, we have this filter label here, which is uh denoting that this destination is now filtered. So, let's produce the same audit event again.

A

And we can see for both the destination. We have again received the uh audit event payload, because we have created the filter for this event type. Only uh so now, let's try to produce uh some other audit event for this. I am going to go to merge, request settings and update a status check name which will produce audit event. So.

A

So in our external, uh in our filtered external destination we can see we have not received any payload, but in our uh unfiltered one we are receiving this uh payload in which we are changing the Status check name from QA to QA V2. So this is how you add filters on a external destination. So let's remove this now for this I'm again going to use a graphql mutation and I'm just going to copy this params and paste it here.

A

So we are now removing this repository download operation filter, so I removed it, and let's refresh this page and now we can see the filter label is not present. uh So it's not filtered now and I'm going to produce the same audit event here, QA V3, so this now should be produced in both the external destinations. So here we can see, we have received the audit event uh saying the change from qav2 to QA V3 and for the unfiltered also, we have received the qav2 to qav3, thanks for watching.