Compliance violations report

Tier: Ultimate
Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated

History

The availability of this feature is controlled by a feature flag. For more information, see the history. This feature is available for testing, but not ready for production use. For production use, continue to use the static compliance violations report.

Use the compliance violations report to see a comprehensive view of compliance violations across all projects in your group. The report provides detailed information about violated controls, associated audit events, and allows you to manage violation statuses.

View the compliance violations report

Prerequisites:

You must be an administrator or have the Owner role for the project or group.

To view the compliance violations report:

On the left sidebar, select Search or go to and find your project or group.
Select Secure > Compliance center.

The compliance violations report displays:

Status: The current status of the violation. For example, Needs Review, Resolved, or Dismissed.
Violated control and framework: The specific compliance control that was violated and its associated framework.
Audit Event: Details about the event that triggered the violation.
Project: The project where the violation occurred.
Date detected: When the violation was identified.
Action: Link to view detailed information about the violation.

In the report, you can:

Sort the report by selecting column headers.
Change the status of violations using the status dropdown list.
Navigate through multiple pages of violations by using pagination.
View detailed information about each violation.

Violation details

When you select Details for a specific violation, you can view:

The violation ID and status.
Location (project) where the violation occurred.
Comprehensive audit event information including:
- Event author.
- Event target.
- Event details.
- IP address.
- Target type.
Violated control information including:
- Control name and description.
- Associated compliance framework.
- Requirements.
Fix suggestions with links to resolve the violation.

Manage violation statuses

You can update the status of compliance violations to track their remediation progress. Available statuses include:

Needs Review: Default status for new violations
In Progress: Violation is being addressed
Resolved: Violation has been remediated
Dismissed: Violation has been reviewed and dismissed

To change a violation status:

In the compliance violations report, locate the violation you want to update.
Select the current status dropdown list in the Status column.
Choose the new status from the dropdown list menu.

The status updates immediately and is reflected in the report.

Static compliance violations report

This feature was deprecated in GitLab 18.2 and is planned for removal in 18.8.

The static compliance violations report provides a high-level view of merge request activity for all projects in the group.

When you select a row in the static compliance violations report, a drawer appears that provides:

The project name and compliance framework label, if the project has one assigned.
A link to the merge request that introduced the violation.
The merge request’s branch path in the format [source] into [target].
A list of users that committed changes to the merge request.
A list of users that commented on the merge request.
A list of users that approved the merge request.
The user that merged the merge request.

View the static compliance violations report

History

Prerequisites:

You must be an administrator or have the Owner role for the project or group.

To view the static compliance violations report:

On the left sidebar, select Search or go to and find your project or group.
Select Secure > Compliance center.

You can sort the compliance report on:

Severity level.
Type of violation.
Merge request title.

You can filter the compliance violations report on:

The project that the violation was found on.
The date range of violation.
The target branch of the violation.

Select a row to see details of the compliance violation.

Severity levels

Each compliance violation has one of the following severities.

Icon	Severity level
	Critical
	High
	Medium
	Low
	Info

Violation types

From GitLab 14.10, these are the available compliance violations.

Violation	Severity level	Category	Description
Author approved merge request	High	Separation of duties	Author of the merge request approved their own merge request. For more information, see Prevent approval by author.
Committers approved merge request	High	Separation of duties	Committers of the merge request approved the merge request they contributed to. For more information, see Prevent approvals by users who add commits.
Fewer than two approvals	High	Separation of duties	Merge request was merged with fewer than two approvals. For more information, see Merge request approval rules.