Connect GitLab

Authorize CISAPP on GitLab.com, link GitLab projects to applications and import their vulnerabilities into findings.

Access: organization administrator. Beta feature; the connector must be enabled on your platform.

Prerequisites

• Be an organization administrator in CISAPP.
• A GitLab.com account that is a member of the projects to monitor with the Developer role or higher. Self-managed GitLab is not supported.
• To import vulnerabilities: projects on GitLab Ultimate with at least one active security scanner (Dependency Scanning, SAST, Container Scanning, Secret Detection…).

Connect the account

1. Open My company → Connectors, then Connect on the GitLab card. A panel sums up the steps and the requested access; click Continue to GitLab.
2. Sign in to GitLab.com if needed, then click Authorize. CISAPP only requests read access to the API (read_api).
3. You return to the connector record in CISAPP with the account's project list.

The authorization link expires after 30 minutes and works once: if something fails, click Connect again.

CISAPP acts with the rights of the GitLab account that authorized the application: preferably use a dedicated account, or one that will stay in the organization.

Link projects to applications

In the Repositories tab, use Link to an application to attach a GitLab project to one of your organization’s applications; the Application column shows the link. Unlink removes the link without changing anything on GitLab. The project then appears in the application’s Code and DevSecOps tab.

The list shows the non-archived projects the account is a member of (Developer role or higher). Synchronize forces an immediate update; otherwise synchronization runs daily.

Import vulnerabilities

A project's GitLab vulnerabilities switch imports its open (detected or confirmed) vulnerabilities from the GitLab vulnerability report into CISAPP findings. Turning it off stops the import: the project's findings are resolved. Nothing changes on GitLab.

• The Open alerts column of the Repositories tab shows the count per severity.
• The Alerts tab shows totals by severity, the Imported repositories and the last synchronization date; View findings opens the findings list filtered on GitLab.
• A vulnerability resolved or dismissed on GitLab is resolved in CISAPP at the next synchronization.

Common issues

Message	What to do
The GitLab connector is not configured	The connector is not available on your platform yet: contact support.
Authorization was denied on GitLab	You clicked Deny: click Connect again and authorize the application.
The GitLab connection could not be validated	Expired or already used link: start the connection again.
This GitLab account is already connected to another organization	A GitLab account can serve only one CISAPP organization: use another account.
No repository synchronized	The account is not a member of any project with the Developer role or higher.
No vulnerability although import is on	The project is not on GitLab Ultimate, or no scanner ran on the default branch.
Synchronization error "reconnect"	Access was revoked on GitLab: disconnect, then connect GitLab again.

Disconnect

Disconnect deletes the connection, the synchronized projects and their links, resolves the GitLab findings and revokes CISAPP's access on GitLab; applications are not changed. You can also review authorized applications from Manage access on GitLab.

Expected result

GitLab projects appear in CISAPP, are linked to the right applications, and their vulnerabilities appear in findings.

See also: Configure connectors.