Public monitoring adds triage, validity, API, and webhooks
By Steven Van ·
Enterprise Cloud customers in the public preview can now dismiss and filter leaked-secret alerts, see token validity, and pull alerts through an API or webhook.
Public monitoring for secret scanning now has alert management, validity checks, a REST API and enterprise webhooks. GitHub already attributes secrets leaked in public repositories back to an enterprise, based on membership or verified domains. Until now there was less to do with those findings once they appeared.
Alert management
Findings can be triaged from the enterprise security dashboard.
- Dismiss and reopen: close an alert as Dismissed or Fixed, add an optional comment, or reopen it if circumstances change.
- Activity timeline: an audit trail of every action and state change on an alert.
- Filter and sort: by repository, committer, secret type, attribution method (membership or verified domain) and state (open or closed).
Closing an alert only updates its state for your enterprise. It does not revoke the exposed credential or remove it from the public repository.
Validity checks
For supported providers, public monitoring now checks token validity on an ongoing basis. Each alert shows whether the credential is Active, Inactive or Unknown, so security teams can prioritise live tokens first.
REST API and webhooks
Enterprise admins and enterprise security managers can query attributed findings with GET /enterprises/{enterprise}/secret-scanning/public-monitoring-alerts. The response includes alert metadata, secret type, attribution and exposed locations.
At the enterprise level, the secret_scanning_public_monitoring_alert webhook event sends a real-time notification whenever a newly detected leak is attributed to the organization.
Availability
Public monitoring remains in public preview for GitHub Enterprise Cloud customers, including GitHub Enterprise Cloud with data residency. It is included with a GitHub Advanced Security or GitHub Secret Protection license at no additional cost. Enterprise admins and enterprise security managers can enable it and manage alert settings from the enterprise security dashboard.
