GitLab Compliance Group - Product, 22 Jun 2023

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Streaming audit events to Splunk

Description

Audit Event Streaming - https://docs.gitlab.com/ee/administration/audit_event_streaming/index.html

Splunk documentation - https://docs.splunk.com/Documentation/Splunk/9.0.5/Data/UsetheHTTPEventCollector

A

Hey everyone,, my name is huzaifa iftikhar and I work as a senior backend engineer in the compliance group of the govern stage at gitlab.

A

Today I'll be demonstrating how we can stream events, gitlab's, audit events, to, splunk using the http event, collector or hec.

A

So I have set up a new splunk enterprise, server. I'll, be following this particular guide to successfully set up streaming between gitlab and splunk..

A

So the first step is to go to the settings. data and data inputs, and here we can see, we have the http event collector, which receives data will be http or https protocol.

A

1:01, so we will go ahead., ensure that all the tokens are enabled globally.. You can either change the port or use the default port, which is created.

A

So I'll just keep it as it is. save it.. The next step is to actually create a new, token, so I'll create a new token and name it as audit events from the gitlab.

A

So this is the token value that I've received from creating this particular token., and we need to use this for setting up the streaming destination at gitlab..

A

I have a test project on gitlab., so let's just go ahead and set up a new streaming destination.. I will go to the secure tab and navigate to audit events.

A

Streams, tab and add a new streaming destination and if you go to the docs., this is the api that we'll be using, and this is how we need to set up the streaming destination.

A

So, I'll copy, this. notice, we need to add the hec port here which was 8088.. Then then we need to use the raw events api, which is this.

A

We also need to add the authorization header here.. We have splunk token that we received.. So I will add this here and go back to splunk and see if any events, our emitted.

A

Go to search and copy., so we have a single event which was from our group, and we went directly to creating streaming headers.

A

Let's go and create some other action.. I have a test project inside this group.- I'll go ahead and perform an action that creates an audit event.

A

So, let's just disable prevent approval by author and save changes. go back to splunk and search.. We have a couple of audit events from gitlab.

A

If you go to the details,, you can also see the prevent users from modifying the approval. Rules for merge requests is false. Now.

A

So, yeah, that's, pretty much it and we've successfully setup streaming audit events from gitlab to splunk.

A