GitHub Dependabot
Overview
Section titled “Overview”Integrate your Risk Register with GitHub Dependabot. This integration imports Dependabot alerts from all repositories in your GitHub organization as risk records, allowing you to manage dependency vulnerabilities alongside your other risks.
- Source: Vulnerability Scanner
- Type: Vulnerability
- Opened By: “GitHubDependabot Integration”
The integration can be enabled directly from your Adversarial tenant via Settings > Integrations. The necessary details to connect your GitHub organization are the Organization (your GitHub organization name) and a Personal Access Token with the security_events scope, authorized for that organization.
Status Mapping
Section titled “Status Mapping”GitHub alert states are mapped to Adversarial risk statuses:
| GitHub State | Adversarial Status | Notes |
|---|---|---|
| Open | New | |
| Fixed | Closed | Closed Date from the fixed timestamp |
| Dismissed | Closed | Closed Date from the dismissed timestamp |
| Auto-dismissed | Closed | Closed Date from the dismissed timestamp |
Severity Mapping
Section titled “Severity Mapping”GitHub severity maps to Adversarial Initially Reported Urgency (IRU). All severities are imported.
| GitHub Severity | Adversarial IRU |
|---|---|
| Critical | Critical |
| High | High |
| Medium | Medium |
| Low | Low |
Fields
Section titled “Fields”| GitHub Field | Adversarial Field | Notes |
|---|---|---|
security_advisory.summary |
Title | |
| (multiple fields) | Description | Assembled from a link to the alert on GitHub, package and manifest information, the advisory summary and description, affected and patched versions, security identifiers (GHSA, CVE, CVSS), and CWE references |
created_at |
Discovered Date | |
fixed_at |
Closed Date | For Fixed alerts |
dismissed_at |
Closed Date | For Dismissed and Auto-dismissed alerts |
security_vulnerability.severity |
IRU | Via severity mapping above |
| (static) | Source | Always “Vulnerability Scanner” |
| (static) | Type | Always “Vulnerability” |