A collection to defend your GitLab Web UI against common attacks:

• GitLab parser
• GitLab brute-force & enumeration detection

Tested with the Omnibus package v14 and v15.

Acquisition template

Example acquisition for this collection:

1---
2filenames:
3 - /var/log/gitlab/gitlab-rails/production_json.log
4labels:
5  type: gitlab

or for Docker:

1---
2source: docker
3container_name:
4 - my_container_name
5labels:
6  type: gitlab

Depending on your gitlab installation method, paths to log files might change. Tip: Don't forget to add GitLabs Nginx logs to CrowdSec.