Connecting Gitlab (on Premise) to Azure Sentinel

Hello Folks,

is it possible to connect Gitlab to Azure Sentinel?
Google was not my friend with this topic :confused:

Is there an how to anywhere?

I think you should be looking at the Azure Sentinel documentation and the possibilities it offers.

for example syslog. All logs on gitlab are under /var/opt/gitlab so should be controlled by the default rsyslog on the underlying Linux system that Gitlab is installed.

If not, then you have this in /etc/gitlab/gitlab.rb related to logging:

## GitLab Logging
##! Docs: https://docs.gitlab.com/omnibus/settings/logs.html
# logging['svlogd_size'] = 200 * 1024 * 1024 # rotate after 200 MB of log data
# logging['svlogd_num'] = 30 # keep 30 rotated log files
# logging['svlogd_timeout'] = 24 * 60 * 60 # rotate after 24 hours
# logging['svlogd_filter'] = "gzip" # compress logs with gzip
# logging['svlogd_udp'] = nil # transmit log messages via UDP
# logging['svlogd_prefix'] = nil # custom prefix for log messages
# logging['logrotate_frequency'] = "daily" # rotate logs daily
# logging['logrotate_size'] = nil # do not rotate by size by default
# logging['logrotate_rotate'] = 30 # keep 30 rotated logs
# logging['logrotate_compress'] = "compress" # see 'man logrotate'
# logging['logrotate_method'] = "copytruncate" # see 'man logrotate'
# logging['logrotate_postrotate'] = nil # no postrotate command by default
# logging['logrotate_dateformat'] = nil # use date extensions for rotated files rather than numbers e.g. a value of "-%Y-%m-%d" would give rotated files like production.log-2016-03-09.gz
### UDP log forwarding
##! Docs: http://docs.gitlab.com/omnibus/settings/logs.html#udp-log-forwarding
##! remote host to ship log messages to via UDP
# logging['udp_log_shipping_host'] = nil
##! override the hostname used when logs are shipped via UDP,
# logging['udp_log_shipping_hostname'] = nil
##! remote port to ship log messages to via UDP
# logging['udp_log_shipping_port'] = 514

you can configure rsyslog on another Linux server to receive input (there are plenty of articles via google to find that will tell you how to configure rsyslog for this), and you can then configure gitlab.rb to redirect the logs to this system. And then configure Azure Sentinel to target the syslogs on that second server that you sent the logs to.