Ingesting audit logs from Gitlab

[keso]

Hey, please, I'd like to ingest audit gitlab logs into Chronicle. There is already some documentation [1]. When following the steps and configuring a new feed type it is possible to select Gitlab as a Log Type. My question comes in the 2nd step. In the input parameters, which should be the -Storage bucket URI-? our gitlab runs in GKE. Is there a guide that shows how to integrate with another product ("log type") maybe? Thank you.

First step:

Second step:

[1] https://cloud.google.com/chronicle/docs/administration/feed-management#storage-example

[Ben_T]

Hi Keso,

If the gitlab instance is running on GKE then I think the first steps might be to determine how GKE logs are currently configured to flow. If they're already routing to a bucket then you should be able to provide that path to the feed configuration in your screenshots. If not, it may be necessary to have the routing configure for that bucket destination.

I've included the relevant docs below.

https://cloud.google.com/kubernetes-engine/docs/concepts/about-logshttps://cloud.google.com/logging/...

[keso]

Hi, the logs from gitlab are sent to cloud logging where it is possible to see them. But when I try to configure the filter in Chronicle to ingest them, there is an error that says "The provided filter can potentially allow unsupported log types." so it is not possible to consume in that way. By design the GKE logs end up in Cloud Logging. How could the logs be ingested in that scenario? 

[Ben_T]

Hi Keso, one things you could check for that issue are:

1. it should be logName instead of log_name in the filter expression - and there should be a field logName in the log itself in logs explorer.
2. Check that the regex works for the logName

Alternatively, you're there are other workaround options to get that data to SecOps such as:
Pub/Sub: You can set up a Pub/Sub topic to receive the filtered GitLab logs from Cloud Logging. Then, configure Chronicle to subscribe to that topic and ingest the logs.

Hope this helps.

[keso]

Hey, yes, we are using           logname = "<name>"      in the filter and the log itself contains the logName field and it matches the <name>.

When checking the filter in cloud logging we are able to see the logs that we want to be ingested by Chronicle. But, when configuring the ingestion filter it fails with the error  "The provided filter can potentially allow unsupported log types."

By design we are sending the logs to a log bucket, so the logs are already there and we would like to use the ingestion filter to ingest them. Please, how could that be done?