Gitlab Owner-scope token modifies approval rules, protected branches, or membership
Detects an Owner-role GitLab account or token modifying merge-request approval rules, protected-branch settings, or project membership -- controls that, if weakened, defeat code-review safeguards.
Microsoft Sentinel (KQL)

