SECOPS
Hourly hunt for GitLab tokens used from flagged Cloudflare bot IPs
Every hour this joins Cloudflare bot-flagged IPs (stored in Axiom) against GitLab token authentication logs and writes a ranked correlation report back to Axiom.
How it runs
The automated pipeline, trigger to output.
- TriggerHourly schedule
- ActionQuery Axiom for Cloudflare-flagged bot IPs (last hour)Axiom
- ActionPull GitLab token auth events for the windowGitLab
- LogicJoin bot IPs to token logins and score by scope
- OutputWrite scored correlation dataset to AxiomAxiom
What it does
This is a scheduled threat hunt rather than a real-time alert. Once an hour it reads the rolling list of IPs that Cloudflare flagged as bots into Axiom, then checks GitLab's authentication and token-usage logs for any token that logged in from one of those addresses. Matches are scored by token scope and written back to Axiom as a dataset your SOC can dashboard and trend.
When to use it
Use this when you want continuous, low-noise coverage that complements real-time paging — catching slow-burn token abuse where an attacker drips requests below spike thresholds. It is ideal for teams already centralizing logs in Axiom who want a queryable record of bot-IP-to-token correlations over time.
How it works
- 1An hourly schedule kicks off the hunt.
- 2The flow queries Axiom for Cloudflare-flagged bot IPs seen in the last hour.
- 3It pulls GitLab token authentication events for the same window.
- 4A logic step joins the two sets and scores each hit by token scope and frequency.
- 5The scored correlation report is written back to Axiom as a structured dataset for dashboards and trending.
Set it up
What you configure once, before turning it on.
- 1Connect AxiomLog streams, queries, dashboards.
- 2Connect GitLabRepos, MRs, pipelines, registry.
- 3Set each agent's modelWe leave models unset so you pick the tier — fast + cheap, or top-quality.
- 4Tune it to your dataEdit the prompts, filters, and field mappings so it matches how your team works.
- 5Test, then turn it onRun once against a sample, confirm the output, then enable the trigger.
More SecOps workflows
Post-Revocation Verification and Audit Logging
After a key is revoked, it confirms the old credential actually fails, verifies the replacement works.
Page on-call when a WAF rule mass-blocks legitimate traffic
On demand or every few minutes, it detects a single Cloudflare WAF rule suddenly blocking a broad spread of ASNs and paths (a likely false-positive storm).
PII Content Scan on New Dropbox External Share
When a file gets an external Dropbox link, it reads the file content, uses an AI classifier to detect PII or secrets.
Compile a weekly WAF tuning review with trends to Confluence
Every week an agent rolls up Cloudflare WAF block clusters by rule and ASN, compares them to prior weeks for trend direction.
Sensitive Dropbox Link Owner Remediation Loop
When a newly created Dropbox shared link points to a sensitive file, this workflow DMs the file owner, gives them a deadline to justify or revoke it.
GitLab Push Secret Detection to Block and History Purge
On a GitLab push that contains a detected secret, it revokes the exposed credential, opens a tracking issue with git-history purge instructions.
Run it inside a business
This workflow drops into a full company template. Import the org, and this is one of the playbooks its agents run.
Run this workflow in your colony.
14-day trial. No DevOps. No Sales call. Provisioned in under a minute.