Gain Control Over Your Security Posture with Delegated Alert Dismissal 🔔

[ghostinhershell]

We're excited to introduce a new feature designed to help you maintain control over your organization's security posture: delegated alert dismissal. This feature allows you to require a review process before dismissing alerts in code scanning and secret scanning. It’s a great way to better manage security risks and meet audit and compliance requirements.

Key Benefits

Delegated alert dismissal lets you:

• Require a review process before alerts are dismissed.
• Ensure dismissals are justified with mandatory comments.
• Maintain transparency with email notifications and detailed alert timelines.

Balancing Security and Development

While this feature adds oversight and control, it’s important to balance your security needs with development speed. Consider the following:

• Who has the authority to close alerts.
• When and how alerts should be closed.
• Who should review and approve dismissal requests.

Configuration and Management

You can configure and manage this feature at scale using security configurations or at the repository level. Each dismissal request requires a mandatory comment explaining the rationale, and email notifications keep both approvers and requesters in the loop. If a request is rejected, the alert remains open.

By default, organization owners and security managers can review and approve dismissal requests. Enabling this feature won't change the state of previously dismissed alerts.

Visibility and Audit Trails

The dismissal and approval process is visible on the alert timeline, included in the audit log, and accessible through both the REST API and webhooks, providing full transparency and traceability.

Availability

You can enable delegated alert dismissal today for code scanning and secret scanning in GitHub Enterprise Cloud. This feature will also be available in version 3.17 of GitHub Enterprise Server.

Stay secure and maintain control over your organization's security posture with delegated alert dismissal!