-
Notifications
You must be signed in to change notification settings - Fork 104
RADAR Event state #1183
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
RADAR Event state #1183
Changes from all commits
122917c
17663e4
a2f76fc
2b61fbd
af67432
78f1179
92ce958
be635c5
82c97b2
370c2d1
e0f1f63
8c43998
f9dc2a4
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,28 @@ | ||
| --- | ||
| page_title: HCP Vault Radar event workflow | ||
| description: >- | ||
| HCP Vault Radar event workflow and its states | ||
| --- | ||
|
|
||
|
|
||
| # Vault Radar Events | ||
|
|
||
| HCP Vault Radar creates an event each time it finds content that matches the criteria of a secret type or a custom expression. Events provide context for remediation and allow security teams to keep track of its progress. | ||
|
|
||
| You can track the remediation of findings using event states which can be set automatically or by a user. | ||
|
|
||
|
|
||
| ## Event status | ||
|
|
||
| - **New** - the default state when HCP Vault Radar creates a new event | ||
|
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. nit: the default status? |
||
| - **Notified** - set automatically when Radar sends an alert or notification. This state cannot be set manually | ||
| - **To Remediate** - set by a developer to confirm that the event needs to be remediated | ||
| - **Secret Stored** - set automatically when a developer triggers a remediation action, though developers can set it manually as well. To learn more about [remediation actions](../remediate-secrets/copy-secrets) | ||
| - **Secret Revoked** - set by a developer to confirm they revoked the secret value. | ||
| - **Resolved** - set by a developer to confirm remediation is complete | ||
| - **False Positive** - set by a developer to confirm the event is a false positive | ||
| - **Ignore Rule** - set automatically when a developer uses the inline ignore rule or sets an ignore rule within a repo via YAML file. To learn more about [inline ignore rules](./write-inline-ignore-rules). | ||
|
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. nit: Should we also add that |
||
| - **Not Important** - sets automatically when an event meets a global ignore rule's criteria. To learn more about [global ignore rules](./write-global-ignore-rules). | ||
|
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Users can also set the event status to
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. And do we include any more information around other times we automatically put it in
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Yes, there should be a corresponding tag in the event details when we automatically set it to |
||
|
|
||
|  | ||
|
|
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
nit: Do we need to change the terminology to
status? I seestateused a bunch in this page 😅