GitHub
Import GitHub security alerts: Dependabot and code-scanning alerts as risks, secret-scanning alerts as security signals.
At a glance
| Direction | Into Aegis. |
|---|---|
| What it brings in | Dependabot, code-scanning and secret-scanning alerts of the organisation (or your personal repositories when no organisation is set). |
| Where it lands | Dependabot and code-scanning alerts become risks; secret-scanning alerts go to the security signal inbox for review. |
| Credentials and permissions |
A GitHub OAuth app (client ID and secret) requesting the scopes
security_events and repo; an administrator
signs in once with Authorize with GitHub.
|
| Owner of imported records | Risks belong to the person who ran the sync. Signals have no owner until a reviewer accepts one. |
| When it runs | On demand with the sync button on the connector page, or through the API. |
| Set it up |
/connectors/github, by people allowed to configure
connectors, on a plan that includes the connector.
|
Good to know
- A sync schedule, or a call to the inbound GitHub webhook, does not import GitHub alerts yet: the run is recorded as failed. Use the sync button.
- The OAuth app's callback address must match the one shown on the connector page exactly.