GitHub
Import GitHub security alerts: Dependabot and code-scanning alerts as risks, secret-scanning alerts as security signals.
At a glance
| Direction | Into Aegis. |
|---|---|
| What it brings in | Dependabot, code-scanning and secret-scanning alerts of the organisation (or your personal repositories when no organisation is set). |
| Where it lands | Dependabot and code-scanning alerts become risks; secret-scanning alerts go to the security signal inbox for review. |
| Credentials and permissions |
A GitHub OAuth app (client ID and secret) requesting the scopes
security_events and repo; an administrator
signs in once with Authorize with GitHub.
|
| Owner of imported records | Risks belong to the person who ran the sync. Signals have no owner until a reviewer accepts one. |
| When it runs | On demand with the sync button on the connector page or through the API, on a sync schedule, and when the inbound GitHub webhook fires. |
| Set it up |
/connectors/github, by people allowed to configure
connectors, on a plan that includes the connector.
|
Good to know
- A scheduled or webhook-triggered sync imports organisation-wide Dependabot and secret-scanning alerts (critical and high). Its risks are owned by the connector's default owner. Without one, or when that user can no longer sign in, they go to the person who last configured the connector, or the longest-standing active administrator when that person can no longer sign in either. The connector page recommends setting a default owner. An alert already imported is not imported again.
- The OAuth app's callback address must match the one shown on the connector page exactly.