Skip to content

Commit e6a2523

Browse files
sabrowning1lecoursenmchammer01
authored
Separate out existing how-to and reference content on the SRA (#57752)
Co-authored-by: Laura Coursen <lecoursen@github.com> Co-authored-by: mc <42146119+mchammer01@users.noreply.github.com>
1 parent ce019e8 commit e6a2523

File tree

8 files changed

+108
-69
lines changed

8 files changed

+108
-69
lines changed

‎content/code-security/securing-your-organization/understanding-your-organizations-exposure-to-leaked-secrets/about-secret-risk-assessment.md‎

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -56,8 +56,4 @@ Because the {% data variables.product.prodname_secret_risk_assessment %} report
5656

5757
## Next steps
5858

59-
Now that you know about the {% data variables.product.prodname_secret_risk_assessment %} report, you may want to learn how to:
60-
61-
* Generate the report to see your organization risk. Navigate to {% data reusables.security-overview.navigate-to-risk-assessment %}.
62-
* Interpret the results of the report. See [AUTOTITLE](/code-security/securing-your-organization/understanding-your-organizations-exposure-to-leaked-secrets/interpreting-secret-risk-assessment-results).
63-
* Enable {% data variables.product.prodname_GH_secret_protection %} to improve your secret leak footprint. See [AUTOTITLE](/code-security/securing-your-organization/understanding-your-organizations-exposure-to-leaked-secrets/choosing-github-secret-protection#enabling-secret-protection).
59+
To start analyzing your organization's secret risk, see [AUTOTITLE](/code-security/securing-your-organization/understanding-your-organizations-exposure-to-leaked-secrets/assess-your-secret-risk).

‎content/code-security/securing-your-organization/understanding-your-organizations-exposure-to-leaked-secrets/assess-your-secret-risk.md‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
---
2+
title: 'Running the secret risk assessment for your organization'
3+
shortTitle: 'Assess your secret risk'
4+
intro: 'Determine your organization''s exposure to leaked secrets by generating a {% data variables.product.prodname_secret_risk_assessment %} report.'
5+
product: '{% data reusables.gated-features.secret-risk-assessment-report %}'
6+
permissions: '{% data reusables.permissions.secret-risk-assessment-report-generation %}'
7+
type: how_to
8+
versions:
9+
feature: secret-risk-assessment
10+
topics:
11+
- Code Security
12+
- Secret scanning
13+
- Secret Protection
14+
- Organizations
15+
- Security
16+
---
17+
18+
## Generating an initial {% data variables.product.prodname_secret_risk_assessment %}
19+
20+
{% data reusables.organizations.navigate-to-org %}
21+
{% data reusables.organizations.security-overview %}
22+
{% data reusables.security-overview.open-assessments-view %}
23+
{% data reusables.security-overview.generate-secret-risk-assessment-report %}
24+
25+
{% data reusables.secret-risk-assessment.notification-report-ready %}
26+
27+
## Rerunning the {% data variables.product.prodname_secret_risk_assessment %}
28+
29+
> [!NOTE]
30+
> You can only generate a secret risk assessment report once every 90 days.
31+
32+
{% data reusables.organizations.navigate-to-org %}
33+
{% data reusables.organizations.security-overview %}
34+
{% data reusables.security-overview.open-assessments-view %}
35+
1. Towards the top right side of the existing report, click {% octicon "kebab-horizontal" aria-label="The horizontal kebab icon" %}.
36+
1. Select **Rerun scan**.
37+
38+
{% data reusables.secret-risk-assessment.notification-report-ready %}
39+
40+
## Next steps
41+
42+
Now that you've generated a {% data variables.product.prodname_secret_risk_assessment %} report for your organization, learn how to interpret the results. See [AUTOTITLE](/code-security/securing-your-organization/understanding-your-organizations-exposure-to-leaked-secrets/interpreting-secret-risk-assessment-results).

‎content/code-security/securing-your-organization/understanding-your-organizations-exposure-to-leaked-secrets/export-risk-report-csv.md‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
---
2+
title: 'Exporting the secret risk assessment report to CSV'
3+
shortTitle: 'Export risk report CSV'
4+
intro: 'Export the {% data variables.product.prodname_secret_risk_assessment %} report to a CSV file for detailed investigation and stakeholder sharing.'
5+
product: '{% data reusables.gated-features.secret-risk-assessment-report %}'
6+
permissions: '{% data reusables.permissions.secret-risk-assessment-report-generation %}'
7+
type: how_to
8+
versions:
9+
feature: secret-risk-assessment
10+
topics:
11+
- Code Security
12+
- Secret scanning
13+
- Secret Protection
14+
- Organizations
15+
- Security
16+
---
17+
18+
{% data reusables.organizations.navigate-to-org %}
19+
{% data reusables.organizations.security-overview %}
20+
{% data reusables.security-overview.open-assessments-view %}
21+
1. Towards the top-right side of the report, select the {% octicon "kebab-horizontal" aria-label="More options" %} dropdown menu, then click {% octicon "download" aria-hidden="true" aria-label="download" %} **Download CSV**.
22+
23+
## Next steps
24+
25+
To better understand the fields of your CSV file, see [AUTOTITLE](/code-security/securing-your-organization/understanding-your-organizations-exposure-to-leaked-secrets/risk-report-csv-contents).

‎content/code-security/securing-your-organization/understanding-your-organizations-exposure-to-leaked-secrets/index.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,10 @@ topics:
1212
- Security
1313
children:
1414
- /about-secret-risk-assessment
15+
- /assess-your-secret-risk
1516
- /viewing-the-secret-risk-assessment-report-for-your-organization
17+
- /export-risk-report-csv
18+
- /risk-report-csv-contents
1619
- /interpreting-secret-risk-assessment-results
1720
- /choosing-github-secret-protection
1821
- /calculating-the-cost-savings-of-push-protection

‎content/code-security/securing-your-organization/understanding-your-organizations-exposure-to-leaked-secrets/interpreting-secret-risk-assessment-results.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ In this tutorial, you'll interpret your secret risk assessment results, and lear
2323

2424
## Prerequisites
2525

26-
You must generate a {% data variables.product.prodname_secret_risk_assessment %} report and wait for the scan to complete. See [AUTOTITLE](/code-security/securing-your-organization/understanding-your-organizations-exposure-to-leaked-secrets/viewing-the-secret-risk-assessment-report-for-your-organization#generating-an-initial-secret-risk-assessment).
26+
You must generate a {% data variables.product.prodname_secret_risk_assessment %} report and wait for the scan to complete. See [AUTOTITLE](/code-security/securing-your-organization/understanding-your-organizations-exposure-to-leaked-secrets/assess-your-secret-risk).
2727

2828
## Step 1: Understand your dashboard metrics
2929

@@ -71,7 +71,7 @@ If you see **many secrets of the same type** (for example, multiple AWS keys), t
7171
* Developers may not be using environment variables
7272
* Missing documentation on secret management
7373

74-
## Step 5: Prioritizing remediation and related actions
74+
## Step 5: Prioritize remediation and related actions
7575

7676
Now that you understand the metrics, prioritize remediation based on risk.
7777

‎content/code-security/securing-your-organization/understanding-your-organizations-exposure-to-leaked-secrets/risk-report-csv-contents.md‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
---
2+
title: 'Contents of the secret risk assessment report CSV'
3+
shortTitle: 'Risk report CSV contents'
4+
intro: 'Understand the data included in the CSV export of the {% data variables.product.prodname_secret_risk_assessment %} report.'
5+
product: '{% data reusables.gated-features.secret-risk-assessment-report %}'
6+
permissions: '{% data reusables.permissions.secret-risk-assessment-report-generation %}'
7+
type: reference
8+
versions:
9+
feature: secret-risk-assessment
10+
topics:
11+
- Code Security
12+
- Secret scanning
13+
- Secret Protection
14+
- Organizations
15+
- Security
16+
---
17+
18+
The {% data variables.product.prodname_secret_risk_assessment %} report CSV file includes the following information:
19+
20+
| CSV column | Name | Description |
21+
| ---------- | ---------------------- | --------------------------------------------------------- |
22+
| A | `Organization Name` | The name of the organization the secret was detected in |
23+
| B | `Name` | The token name for the type of secret |
24+
| C | `Slug` | The normalized string for the token. This corresponds to `Token` in the table of supported secrets. See [AUTOTITLE](/code-security/secret-scanning/introduction/supported-secret-scanning-patterns#supported-secrets). |
25+
| D | `Push Protected` | A `boolean` to indicate whether the secret would be detected and blocked by push protection if it were enabled |
26+
| E | `Non-Provider Pattern` | A `boolean` to indicate whether the secret matched a non-provider pattern and would generate an alert if {% data variables.product.prodname_secret_scanning %} with non-provider patterns were enabled |
27+
| F | `Secret Count` | An aggregate count of the active and inactive secrets found for the token type |
28+
| G | `Repository Count` | An aggregate count of distinct repositories in which the secret type was found, including public, private,{% ifversion ghec or ghes %} internal,{% endif %} and archived repositories |
29+
30+
## Next steps
31+
32+
To learn which secrets you should prioritize for remediation, see [AUTOTITLE](/code-security/securing-your-organization/understanding-your-organizations-exposure-to-leaked-secrets/interpreting-secret-risk-assessment-results#step-5-prioritizing-remediation-and-related-actions).

‎content/code-security/securing-your-organization/understanding-your-organizations-exposure-to-leaked-secrets/viewing-the-secret-risk-assessment-report-for-your-organization.md‎

Lines changed: 2 additions & 61 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
---
22
title: 'Viewing the secret risk assessment report for your organization'
3-
shortTitle: 'View secret risk assessment'
4-
intro: 'You can generate and view the {% data variables.product.prodname_secret_risk_assessment %} report for your organization from the "Security" tab.'
3+
shortTitle: 'View risk report'
4+
intro: 'Understand your organization''s exposure to leaked secrets at a glance by viewing your most recent {% data variables.product.prodname_secret_risk_assessment %} report.'
55
product: '{% data reusables.gated-features.secret-risk-assessment-report %}'
66
permissions: '{% data reusables.permissions.secret-risk-assessment-report-generation %}'
77
allowTitleToDifferFromFilename: true
@@ -16,65 +16,6 @@ topics:
1616
- Security
1717
---
1818

19-
{% data reusables.secret-risk-assessment.report-intro %} {% data reusables.secret-risk-assessment.link-conceptual-information %}
20-
21-
You can generate the {% data variables.product.prodname_secret_risk_assessment %} report for your organization, review it, and export the results to CSV.
22-
23-
## Generating an initial {% data variables.product.prodname_secret_risk_assessment %}
24-
25-
{% data reusables.organizations.navigate-to-org %}
26-
{% data reusables.organizations.security-overview %}
27-
{% data reusables.security-overview.open-assessments-view %}
28-
{% data reusables.security-overview.generate-secret-risk-assessment-report %}
29-
30-
{% data reusables.secret-risk-assessment.notification-report-ready %}
31-
32-
{% note %}
33-
34-
Did you successfully generate the {% data variables.product.prodname_secret_risk_assessment %} report for your organization?
35-
36-
<a href="https://docs.github.io/success-test/yes.html" target="_blank" class="btn btn-outline mt-3 mr-3 no-underline"><span>Yes</span></a> <a href="https://docs.github.io/success-test/no.html" target="_blank" class="btn btn-outline mt-3 mr-3 no-underline"><span>No</span></a>
37-
38-
{% endnote %}
39-
40-
## Rerunning the {% data variables.product.prodname_secret_risk_assessment %}
41-
42-
{% data reusables.security-overview.secret-risk-assessment-report-generation-cadence %}
43-
44-
{% data reusables.organizations.navigate-to-org %}
45-
{% data reusables.organizations.security-overview %}
46-
{% data reusables.security-overview.open-assessments-view %}
47-
1. Towards the top right side of the existing report, click {% octicon "kebab-horizontal" aria-label="The horizontal kebab icon" %}.
48-
1. Select **Rerun scan**.
49-
50-
{% data reusables.secret-risk-assessment.notification-report-ready %}
51-
52-
## Viewing the {% data variables.product.prodname_secret_risk_assessment %}
53-
5419
{% data reusables.organizations.navigate-to-org %}
5520
{% data reusables.organizations.security-overview %}
5621
{% data reusables.security-overview.open-assessments-view %} You can see the most recent report on this page.
57-
58-
## Exporting the {% data variables.product.prodname_secret_risk_assessment %} to CSV
59-
60-
{% data reusables.organizations.navigate-to-org %}
61-
{% data reusables.organizations.security-overview %}
62-
{% data reusables.security-overview.open-assessments-view %}
63-
1. Towards the top right side of the report, click {% octicon "kebab-horizontal" aria-label="More options" %}.
64-
1. Select **Download CSV**.
65-
66-
The {% data variables.product.prodname_secret_risk_assessment %} CSV file includes the following information.
67-
68-
| CSV column | Name | Description |
69-
| ---------- | ---------------------- | --------------------------------------------------------- |
70-
| A | `Organization Name` | The name of the organization the secret was detected in |
71-
| B | `Name` | The token name for the type of secret |
72-
| C | `Slug` | The normalized string for the token. This corresponds to `Token` in the table of supported secrets. See [AUTOTITLE](/code-security/secret-scanning/introduction/supported-secret-scanning-patterns#supported-secrets). |
73-
| D | `Push Protected` | A `boolean` to indicate whether the secret would be detected and blocked by push protection if it were enabled |
74-
| E | `Non-Provider Pattern` | A `boolean` to indicate whether the secret matched a non-provider pattern and would generate an alert if {% data variables.product.prodname_secret_scanning %} with non-provider patterns were enabled |
75-
| F | `Secret Count` | An aggregate count of the active and inactive secrets found for the token type |
76-
| G | `Repository Count` | An aggregate count of distinct repositories in which the secret type was found, including public, private,{% ifversion ghec or ghes %} internal{% endif %}, and archived repositories |
77-
78-
## Next steps
79-
80-
Now that you've generated {% data variables.product.prodname_secret_risk_assessment %} for your organization, learn how to interpret the results. See [AUTOTITLE](/code-security/securing-your-organization/understanding-your-organizations-exposure-to-leaked-secrets/interpreting-secret-risk-assessment-results).

‎data/reusables/gated-features/secret-risk-assessment-report.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
{% data variables.product.prodname_secret_risk_assessment_caps %} is available for free in organizations on {% data variables.product.prodname_team %} and {% data variables.product.prodname_enterprise %}
1+
Free for organizations on {% data variables.product.prodname_team %} and {% data variables.product.prodname_enterprise %}

0 commit comments

Comments
 (0)