GitLab SaaS

Integrate Cortex Cloud Application Security with your GitLab SaaS version control system (VCS) to enable security scans for exposed secrets, infrastructure-as-code (IaC) misconfigurations, vulnerabilities, package operational risks, and license compliance issues in your repositories. This integration allows you to analyze, prioritize, and resolve detected issues efficiently.

How to integrate GitLab SaaS

Prerequisites

Cortex Cloud requirements

• User permissions: Ensure you have View/Edit permissions for Data Sources and Integrations. You need the AppSec Admin or Instance Administrator role.
• Egress path: Create an egress path for outbound data transmission to third-party services. For configuration details, see Egress Configurations.

GitLab SaaS requirements

• Permissions: You need the following GitLab permissions:

  • Maintainer (project-level): Configures external integrations, repository access, and CI/CD settings.
  • Administrator (repository-level): Required for pull-request scans. This permission lets Cortex Cloud configure webhooks for selected repositories.
• Authorization scope: The Cortex application requires the api scope. It provides read and write access to groups, projects, container registries, dependency proxies, and package registries.

Onboarding steps

1. In the Cortex Cloud tenant.

   1. Navigate to Settings → Data Sources & Integrations → + Add New.
   2. Search for GitLab (SaaS) , hover over it and click Add, or Add Another Instance if an instance is already onboarded.
   3. Click Authorize on the Configure account step of the GitLab SaaS onboarding wizard.

      You are redirected to your GitLab SaaS account in order to install and authorize Cortex AppSec, the GitLab App application handling the Cortex Cloud Application Security functionality.
2. On GitLab SaaS: Review the requested permissions and click Authorize Cortex AppSec.

   You are redirected to the Select Repositories step of the installation wizard on the console.

   Cortex Cloud subscribes to GitLab SaaS events after authorization. See Reference A: Subscribed events.
3. On the Cortex Cloud console.

   1. Under Selection Options, choose the repositories to be connected to the instance:

      • Permit all existing repositories
      • Permit all existing and future repositories
      • Choose from repository list → select repositories from the list
   2. Click Save.

      Note

      A repository can only be integrated with a single instance. The first instance that connects with the repository will be the one that the repository is assigned to. This means that if multiple integrations attempt to connect to the same repository, only the first integration to establish the connection will be associated with that repository.

Verify integration

Verify the integration by confirming that your GitLab SaaS instance has a status of Connected.

1. On the Data Sources & Integrations page, search for GitLab (SaaS).
2. Select the resulting entry.
3. Locate your instance and verify its status is Connected.

Next steps

View repository assets and mitigate detected issues.

Troubleshoot instance path errors

If your VCS instance shows an error with the message Path was not approved in the egress, you must ensure that your VCS organization's path is approved in the Cortex Gateway. For more information, refer to Egress Configurations.

Manage the integration

Instance-level actions

1. Navigate to Settings → Data Sources & Integrations and search for GitLab (SaaS).
2. Select the matching result.
3. Locate your instance from the displayed list, right-click it, then select an option:

   • Edit instance: Opens the onboarding wizard, where you can change the instance configuration.
   • Delete instance: Deletes the instance and previous scan data.
   • Copy entire row: Copies all row values to the clipboard.

Repository-level actions

Right-click a connected repository to Set Scanned Branches, run a manual scan through Scan Repository, modify the Scan Configuration, or Remove Repository entirely. You can toggle specific scanners and manage PR behavior in Scan Configuration.

1. Locate your instance. See Verify integration above.
2. Select the instance. A list of connected repositories appears.
3. Right-click a repository, select the required action, then click Save.