Use Suricata to Query Network Security Logs Linked to Each Job
What does this MR do?
Building off of the GitLab Runner Referees features introduced in !1545 (merged), the Network Referee uploads job-specific Suricata logs to GitLab as job artifacts for each job.
Why was this MR needed?
We do not have visibility into what network activity our runners are generating on a per-job basis. Suricata is a free and open source, mature, fast and robust network threat detection engine that is already in-place on our production runners but not enabled/used this is going to be done in https://dev.gitlab.org/cookbooks/packer-runner-machines/-/merge_requests/34. When configured properly with rules, Suricata will provide valuable insight into specific network activities occurring within jobs.
Does this MR meet the acceptance criteria?
-
Documentation created/updated -
Added tests for this feature/bug -
In case of conflicts with master- branch was rebased
What are the relevant issue numbers?
Edited by Steve Xuereb