GitLab token/account holds Owner access across 50+ projects
Detects a single GitLab token/account holding Owner-level access across an unusually large number of projects (50+), the standing-privilege condition that turned one leaked token into a 55-project supply-chain exposure.
Microsoft Sentinel (KQL)

