## Overview This epic collates all issues related to adding audit events for runners in GitLab. ## Background / Audit Requirement Prior to the work on the issues in this epic, there are no [audit events](https://docs.gitlab.com/ee/development/audit_event_guide/#what-are-audit-events) being generated when a GitLab Runner is registered, assigned to a project, or unregistered. Having audit logs is highly desirable in the event of a runners registration token leak since it allows retrieving a list of newly registered runners since the leak. Note: there is an existing issue that covers more scenarios regarding also Runner settings: https://gitlab.com/gitlab-org/gitlab/-/issues/8074 ## Scope ### :white_check_mark: New runner registration events Add the following audit events for when a GitLab Runner is registered at the instance, group, or project level. - Date and timestamp in UTC - Public IP address (i.e. the source IP address from where the registration command was run) - registration token - ideally: source of the request (`graphql`, `rest`) ### Runner creation events Add the following audit events for when a GitLab Runner is created at the instance, group, or project level. - Date and timestamp in UTC - Public IP address (i.e. the source IP address from where the operation was run) - Authenticated user - Runner ID - ideally: source of the request (`graphql`, `rest`) ### :white_check_mark: Runner removal events Add the following audit event for when a GitLab Runner is unregistered at the instance, group, or project level. - Date and timestamp in UTC - Public IP address (i.e. the source IP address from where the registration command was run) - authentication token (or user, if a user is authenticated) - ideally: source of the request (`graphql`, `rest`) ### Changes to a previously registered runners configuration - `active` property - Executor (this is only known after registration once the runner starts requesting jobs) - `tag_list` property - `maximum_timeout` property - ideally: source of the request (`graphql`, `rest`) - {placeholder} ### Shared runners are [enabled](https://docs.gitlab.com/ee/ci/runners/runners_scope.html#enable-shared-runners)/[disabled](https://docs.gitlab.com/ee/ci/runners/runners_scope.html#disable-shared-runners) for a group/project - Date and timestamp in UTC - Public IP address (i.e. the source IP address from where the command was run) - User - Project/namespace path - {placeholder} ### Group runners are enabled/disabled for a project? - Date and timestamp in UTC - Public IP address (i.e. the source IP address from where the command was run) - User - Project path - {placeholder} ### [Runner registration token reset](https://docs.gitlab.com/ee/api/runners.html#reset-instances-runner-registration-token) - Date and timestamp in UTC - Public IP address (i.e. the source IP address from where the command was run) - User - Short version of previous token value (as it is no longer valid)? - NOTE: will be removed with %"17.0" - {placeholder} ## Audit Events Requirements (Solutions Architects) | Event | Is this event type recorded today?| | ------ | ------ | |Registration of a new runner| :white_check_mark: | |Removal of a registered runner| :white_check_mark: | |Runner configuration changes made via the UI, such as timeouts, etc. Whatever changes can be made via the UI, to capture those as audit events.| |Changes to the runner protection| |The forking of a project that use shared runners| |Resetting of the runner authentication token| |Enabling and disabling of runners being able to run untagged jobs |Runner has been upgraded| |Perhaps changes to the enabling/disabling of runner attestation| |Cleaning up of stale runners| |Changes in runner expiration time|