Skip to content
GitLab Next
  • Menu
Projects Groups Snippets
  • /
  • Help
    • Help
    • Support
    • Community forum
    • Submit feedback
    • Contribute to GitLab
  • Sign in / Register
  • GitLab GitLab
  • Project information
    • Project information
    • Activity
    • Labels
    • Members
  • Repository
    • Repository
    • Files
    • Commits
    • Branches
    • Tags
    • Contributors
    • Graph
    • Compare
    • Locked Files
  • Issues 44,258
    • Issues 44,258
    • List
    • Boards
    • Service Desk
    • Milestones
    • Iterations
    • Requirements
  • Merge requests 1,273
    • Merge requests 1,273
  • CI/CD
    • CI/CD
    • Pipelines
    • Jobs
    • Schedules
    • Test Cases
  • Deployments
    • Deployments
    • Environments
    • Releases
  • Packages & Registries
    • Packages & Registries
    • Package Registry
    • Container Registry
    • Infrastructure Registry
  • Monitor
    • Monitor
    • Metrics
    • Incidents
  • Analytics
    • Analytics
    • Value stream
    • CI/CD
    • Code review
    • Insights
    • Issue
    • Repository
  • Snippets
    • Snippets
  • Activity
  • Graph
  • Create a new issue
  • Jobs
  • Commits
  • Issue Boards
Collapse sidebar
  • GitLab.orgGitLab.org
  • GitLabGitLab
  • Issues
  • #213603
Closed
Open
Issue created Apr 06, 2020 by Matt Gonzales (ex-GitLab)@mattgonzales-gitlabContributor

Include changes to approval groups in audit log

Problem to solve

Currently, there are gaps in the Category:Audit Events log for changes made to MR approval settings. Specifically, if an approval group is added or removed, there is no captured audit event. Additionally, if an individual is added or removed to an existing approval group, there is no audit event.

The lack of these events creates a gap in the nonrepudiation posture of a GitLab environment, which can be problematic for audit or compliance stakeholders looking to track down specific information about a change or when satisfying external auditor requirements for evidence of traceability and auditability.

Intended users

  • Sidney (Systems Administrator)
  • Sam (Security Analyst)
  • The management stakeholders who adhere to any auditing process. To be defined in a new Compliance Persona

Further details

We addressed some related gaps in #7531 (closed) but customer feedback has highlighted additional areas for improvement.

Proposal

Capture audit events for:

  • Add/Remove an approval group

(suggested copy) e.g. Approval Group was Added to Project at Date/Time

  • If I add/remove an individual to an existing approval group, no audit event is listed.

(suggested copy) e.g. User was Removed from Approval Group at Date/Time

Permissions and Security

Documentation

Availability & Testing

What does success look like, and how can we measure that?

What is the type of buyer?

Is this a cross-stage feature?

Links / references

Assignee
Assign to
Time tracking