Minor Red Team handbook clarifications

- "**I have some attacker related ideas that could be quite interesting!**" :point_right: [Contact us](#contact-us)

- "**Do you do penetration testing?**" :point_right: No. :smile: We don't do vulnerability enumeration. See [Services we offer](#services-we-offer)

- "**I want to upskill in Red Teaming**" :point_right: See [resources](#additional-resourcesfurther-reading), [Club Red](opportunistic-attacks#club-red)

- "**Can you hack me?**" :point_right: GitLab team members can sign up to our [laptop opt-in programme](https://forms.gle/kMTJEjzktcjAbTVn9)

- "**Can you hack me?**" :point_right: Chat to us about your ideas! [Contact us](#contact-us)

- "**Can you help us with an incident?** Does this look like hacker stuff in these logs?" :point_right: [Contact us](#contact-us)

- "**Can you help find bugs in GitLab the product?**" :point_right: You're better off asking [Security Research](../../product-security/security-platforms-architecture/security-research/)

### Stealth Operations

Our primary service. Stealth operations are typically 3-9 months in length and are focused on emulation of relevant threats to GitLab. We work closely with [Threat Intelligence](../threat-intelligence) to identify an adversary that might pose a security risk to GitLab. Using tools we've developed similar to those of the adversary, we carry out the attack on GitLab's systems. We use stealth, testing the defenses realistically and without introducing unnecessary risk. [Read more...](stealth-operations)

Our primary service. Stealth operations are focused on emulation of relevant threats to GitLab. We work closely with [Threat Intelligence](../threat-intelligence) to identify an adversary that might pose a security risk to GitLab. Using tools we've developed similar to those of the adversary, we carry out the attack on GitLab's systems. We use stealth, testing the defenses realistically and without introducing unnecessary risk. [Read more...](stealth-operations)

### Opportunistic Attacks

### Auditing Red Team Attack Techniques

The Red Team maintains operator logs which include specific details on attack techniques we've conducted, timestamps, source IP addresses, etc. These are included in an operation's final report, but will be redacted to not show specific names of accounts and laptops that may have been compromised.

The Red Team maintains operator logs which include specific details on attack techniques we've conducted, timestamps, source IP addresses, etc. A subset of these are included in an operation's final report, but will be redacted to not show specific names of accounts and laptops that may have been compromised.

If a team member's account or laptop is compromised during an operation, the Red Team will share specific details of all related activity with that team member. This will include the operator logs. The Red Team will offer to meet with them synchronously to explain these logs, if the team member would like that.