​
Overview

The GitLab integration polls the GitLab Audit Events API and ingests:
  • Group, project, and user audit events
  • Merge request approvals, push, and protected branch changes
  • CI/CD pipeline triggers and runner registration
  • Personal, project, and group access token activity
  • Permission and role modifications
Works with gitlab.com and self-hosted GitLab (Premium and Ultimate tiers).

​
Prerequisites

  • A GitLab Premium or Ultimate subscription (audit events API requirement).
  • For groups/instances: an account with Owner (group) or Administrator (self-hosted) permissions.
  • The GitLab base URL: https://gitlab.com for SaaS, or your self-hosted URL.

​
Step 1: Create a Personal Access Token in GitLab

  1. Sign in to GitLab.
  2. Click your avatar → Edit profile → Access tokens.
  3. Click Add new token.
  4. Name it atatus-siem, set an expiry, and select the following scopes:
    • read_api
    • read_audit_log (where available)
  5. Click Create personal access token and copy the value (starts with glpat-).
Instance-level audit events on self-hosted GitLab require an Administrator account; group-level events require Owner of the group.

​
Step 2: Connect GitLab in Atatus

  1. In Atatus, go to Security → Cloud SIEM → Integrations.
  2. Locate the GitLab card and click Connect.
  3. Fill in the form:
  1. Click Connect.

​
Verification

  • The GitLab card shows Configured.
  • Audit events appear in Security → Cloud SIEM → Audit Logs → Events with source gitlab.