GitLab Govern:Threat Insights Features & Demos, 12 Sep 2023

Previous Meeting

Next Meeting

⏯

youtube image

►

From YouTube: Provide & edit dismissal reason in finding modal

Description

Issue:
Provide & edit dismissal reason in finding modal - https://gitlab.com/gitlab-org/gitlab/-/issues/412841

Epic:
Finding Dismissal Reasons - https://gitlab.com/groups/gitlab-org/-/epics/10282

A

Hi I'm Lawrence from the threat insights team at gitlab and I'll be showing to you a new feature that allows you to provide and edit a dismissal reason when dismissing a finding. You can find this by going to the pipeline security tab. So let's go to this Pipeline on this merger Quest and click on the security tab, I'm going to filter a bit on low severity and on the SAS tool and if I click on the info button on this finding, you can see a bit more information and one button to dismiss this vulnerability.

A

This is in contrast to before where this button was split up between an immediate dismiss action or dismiss with a comment. But now, when we select this button, you'll always see an edit section where you can provide a dismissal reason and a dismissal comments.

A

If I would click the confirm dismissal button now you can see that it won't allow me to dismiss, because the dismissal reason is required.

A

If I open up the drop down, you can see the five dismissal reasons which are the same as on the vulnerability detail, space or the vulnerability report page and to help guide.

A

The user, in which reason to select we've, also got this help pop over, which shows the descriptions for all the reasons so for now, I'll select the not applicable reason and I won't give a comment, because it's not required now I confirm it's dismissed if I unselect, the height, dismissed I, can find the finding we just dismissed and I'll open up the model again and now. In this note, we can see both the state and the dismissal reason displayed here now.

A

In this case, I noticed I gave a wrong reason because I noticed the vulnerability actually was found in a test scenario, so I can go ahead and edit the dismissal and instead I'll use the used in tests. Reason.

A

I can confirm that this is the right Reason. By checking the descriptions, the finding is not a vulnerability because it is, it is part of a test or test data which is correct and then I can write a comment with this film ability. It appears in this scenario and I can confirm again if I again check the model I can see. We still have the dismissal reason displayed here with the state, but we've also got the current here below I hope you enjoyed the demo and have a nice day.