# Source: https://docs.datadoghq.com/security/default_rules/def-000-a18.md

---
title: GitLab group access token created
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: Docs > Datadog Security > OOTB Rules > GitLab group access token created
---

# GitLab group access token created

{% alert level="danger" %}
This rule is part of a beta feature. To learn more, [contact Support](https://docs.datadoghq.com/help/).
{% /alert %}
Classification:attackTactic:[TA0003-persistence](https://attack.mitre.org/tactics/TA0003)Technique:[T1098-account-manipulation](https://attack.mitre.org/techniques/T1098) 
## Goal{% #goal %}

Detects when a user creates a group access token in GitLab. Group access tokens provide programmatic access to perform actions for groups and manage the projects within the group.

## Strategy{% #strategy %}

This rule monitors GitLab audit events where `@evt.name` is `group_access_token_created`. The detection includes threat intelligence correlation to identify token creation from known suspicious IP addresses. Group access tokens grant API access to GitLab groups and their associated projects, making them valuable for attackers seeking to maintain persistent access to source code repositories and CI/CD pipelines.

## Triage & Response{% #triage--response %}

- Verify if `{{@usr.name}}` has legitimate business justification for creating a group access token and appropriate permissions to do so.
- Review the scope and permissions granted to the newly created token to ensure they align with the user's role and responsibilities.
- Examine the IP address and user agent associated with the token creation to identify any suspicious access patterns.
- Check if the token creation coincides with other suspicious activities from the same user account or IP address.
- Validate that the user account creating the token has not been compromised by reviewing recent authentication and activity logs.