Gitlab Self-managed

1. Before you begin.

   1. Grant the Prisma Cloud user the necessary permissions for integrating Prisma Cloud with your GitLab Self-managed VCS, as specified in User Permissions below.
   2. Add the Prisma Cloud IP addresses and hostname for Application Security to an allow list to enable access to the Prisma Cloud Console.
   3. Ensure the use of the default port 443 for the integration.
   4. Provide a hostname or IP address that can be resolved on the public DNS.
2. On the Prisma Cloud Application Security console.

   1. In Application Security, select Home > Settings > Connect Provider > Code & Build Providers.

      
   2. Select GitLab Self-managed (under Code Repositories) in the catalog that is displayed.

      

      The Configure Domain step of the integration wizard (wizard) is displayed.
   3. Enter your domain or IP address in the Configure Domain step of the installation wizard> Register.

      The domain is the hostname associated with your self-hosted GitLab instance.

      The Register OAUTH app step of the wizard is displayed.

      
   4. Copy the values Application Name and Redirect URL fields > Next.

      You are redirected to your GitLab Self-managed instance.
3. On the GitLab Self-managed console.

   1. Create an application.

      • Access GitLab Self-Managed > User Settings > Applications.
      • Paste the copied Application Name and Redirect URL in their respective fields.
   2. Select api as the application scope > Save application.
   3. Copy the generated Application ID and Secret values that are displayed after the application is created.

      
4. In the Set Client ID and Secret step of the Prisma Cloud integration wizard.

   1. Paste the generated Application ID and Secret values that you copied above > click Authorize.

      The Select Repositories step of the wizard is displayed.
5. Select which repositories will be scanned.

   • Permit all existing repositories
   • Permit all existing and future repositories. This is the recommended option to ensure complete coverage and successful operation of all features
   • Choose from repository list > Select repositories
6. Select Next > Done in the Status step of the wizard to complete the integration.
7. Verify integration.

   1. In Application Security, select Settings > Code & Build Providers.
   2. Confirm that the status of the integrated GitLab repositories displays Connected under Status.

      It may take up to 3 minutes for the integration status to be updated.
8. Next step: Monitor and manage scan results.

   • View your selected GitLab Self-managed repositories on the Repositories page. The next GitLab Self-managed scan will include these repositories
   • To view scan results and resolve issues, in Application Security select Home > Projects. See Monitor and Manage Code Build Issues for more information

Support for Multiple Integrations

• View a list of integrations on a single console
• Add additional integrations
• Delete an existing integration

1. Add additional integrations to a configured GitLab Self-Managed account.
2. In Application Security, select Settings > Connect Provider > Code & Build Providers > GitLab Self-managed (under Code Repositories).

   1. Select Add Integration in the wizard.
   2. Execute the installation steps above.
3. Next step: Monitor and manage scan results - see step 6 of the integration procedure above.

Manage Integrations

1. Access the GitLab Self-Managed integration wizard - see step 1 of Support for Multiple Integrations above.
2. Select the menu under Actions.

   1. Select Reselect repositories to add or remove repositories
   2. Select Delete Integration to delete integrations

User Permissions

• Maintainer permissions. Grants sufficient permissions to configure external integrations, manage repository access, and adjust CI/CD settings
• api: Grants full read and write access to the API, including all groups and projects, as well as permissions to interact with the container registry, the dependency proxy, and the package registry
• Administrator repository permissions: In order to scan pull requests (PRs), the user performing the integration must have administrative privileges for the repositories. This enables Prisma Cloud to set up subscription webhooks for the selected repositories

Subscribed Events

• merge_requests_events: This event is triggered when merge or pull requests are created, updated, merged, closed, or have changes made to them
• push_events: This event occurs whenever code changes are pushed to a repository, indicating new commits being added to the version control history
• tag_push_events: This event is triggered when new tags are pushed to a repository
• note_events: This event is generated when comments or notes are added to various objects within GitLab, such as issues, merge requests, or commits
• confidential_note_events: Similar to note_events, but specifically for confidential comments or notes that are restricted to certain users or groups
• issues_events: This event is triggered when issues are created, updated, closed, or have changes made to them
• confidential_issues_events: Similar to issues_events, but specifically for confidential issues that are restricted to certain users or groups
• job_events: This event occurs when jobs defined in CI/CD pipelines are created, updated, started, finished, or have changes made to them
• pipeline_events: This event is generated when pipelines are created, updated, started, finished, or have changes made to them
• wiki_page_events: This event occurs when changes are made to wiki pages within GitLab, including creation, updates, and deletions
• deployment_events: This event is triggered when deployments are created, updated, started, finished, or have changes made to them
• releases_events: This event occurs when releases are created, updated, published, or have changes made to them

• subgroup_events: This event is specific to GitLab groups and occurs when changes are made to subgroups within a group hierarchy

• repository_update_events: This event occurs whenever there are updates or changes made to a GitLab repository, including actions such as new commits, branch operations, tag updates, and modifications to repository settings