TLDR Framework

About

This repository contains a collection of threat detection rules, sample log events, queries and response procedures related to GitLab. TLDR (Threat, Logs, Detection, Respond) is a comprehensive framework designed to enhance the understanding and implementation of security detections for GitLab environments. This project aims to provide customers with a holistic view of the threat landscape/attack surface related to GitLab, enabling them to proactively monitor and safeguard their GitLab installations.These detections are designed to help security teams improve their threat hunting and incident response capabilities related to GitLab environments.

Purpose

The TLDR framework addresses the need for a well-organized, comprehensive approach to security detections. It helps customers grasp:

• The threat itself
• Technical and business implications
• Relevant log sources
• Event structures
• Methods to verify proper detection configuration
• Guidance on how to respond in case of a true positive event.

Our goal is to enhance customer experience in terms of detection and response and equip them with necessary information to respond to security incidents related to GitLab.

Structure

Each TLDR detection follows this structure:

1. About: Overview of the threat
2. Threat Details:
   • Technical Details/Impact
   • Business Impact
3. Logs:
   • Required log sources
   • Sample event logs
4. Detection:
   • SIGMA rule or equivalent
   • Raw Log Query (for environments without SIEM)
5. Atomic Test: Instructions to reproduce the threat for testing
6. Response: Guidance on handling the detected threat
7. References: Additional resources and documentation

Sample Detection

For a sample TLDR detection, see Maintainer or Owner Permission Added to a Project.

Benefits

• Comprehensive understanding of threats and their impact
• Clear guidance on log sources and detection methods
• Practical response strategies
• Improved security posture for GitLab environments

Contact

For questions or feedback, please open an issue in the TLDR project.

Disclaimer

The information provided in this repository is for educational and informational purposes only. It is not intended to be, and should not be construed as, legal advice or a guarantee of security. The authors and contributors to this project make no representations or warranties of any kind, express or implied, about the completeness, accuracy, reliability, suitability, or availability of the information contained herein.

Any reliance you place on such information is strictly at your own risk. The authors and contributors will not be liable for any loss or damage arising from the use of this information or the implementation of any detection rules or response procedures outlined in this repository.

Users are responsible for ensuring that their use of the information, detection rules, and response procedures complies with all applicable laws, regulations, and organizational policies. It is strongly recommended to thoroughly test and validate any detection rules or procedures in a controlled environment before implementing them in a production setting.

Users should exercise their own judgment and seek professional advice when necessary to determine the appropriateness of implementing any of the provided information in their specific context.

By using the information in this repository, you acknowledge and agree to these terms and conditions.

Usage

Each detection is provided in a separate file within its respective platform or data source folder. The detections are typically written in the Sigma format and overall file is written in the markdown format. You can convert the Sigma format rule to SIEM specific language using the SIGMA to SIEM converter tools available on the SIG Converter.

To use these detections:

1. Navigate to the appropriate /detections folder.
2. Review the detection rule or query in the file.
3. Adapt the detection to your specific environment if necessary.
4. Implement the detection in your security information and event management (SIEM) system or other relevant security tools.

Contributing

Contributions to this repository are welcome! If you have new detection rules or improvements to existing ones, please follow these steps:

1. Fork the repository.
2. Create a new branch for your changes.
3. Add your detection rule or make improvements to existing ones.
4. Ensure your detection is well-documented and includes any necessary context or references.
5. Submit a merge request with a clear description of your changes.

License

This project is licensed under the MIT License. See the LICENSE file for details.