Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
@@ -0,0 +1,28 @@
---
page_title: HCP Vault Radar event workflow
description: >-
HCP Vault Radar event workflow and its states
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: Do we need to change the terminology to status? I see state used a bunch in this page 😅

---


# Vault Radar Events

HCP Vault Radar creates an event each time it finds content that matches the criteria of a secret type or a custom expression. Events provide context for remediation and allow security teams to keep track of its progress.

You can track the remediation of findings using event states which can be set automatically or by a user.


## Event status

- **New** - the default state when HCP Vault Radar creates a new event
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: the default status?

- **Notified** - set automatically when Radar sends an alert or notification. This state cannot be set manually
- **To Remediate** - set by a developer to confirm that the event needs to be remediated
- **Secret Stored** - set automatically when a developer triggers a remediation action, though developers can set it manually as well. To learn more about [remediation actions](../remediate-secrets/copy-secrets)
- **Secret Revoked** - set by a developer to confirm they revoked the secret value.
- **Resolved** - set by a developer to confirm remediation is complete
- **False Positive** - set by a developer to confirm the event is a false positive
- **Ignore Rule** - set automatically when a developer uses the inline ignore rule or sets an ignore rule within a repo via YAML file. To learn more about [inline ignore rules](./write-inline-ignore-rules).
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: Should we also add that Ignore Rule can't be set manually too? I saw it was called out for Notified ?

- **Not Important** - sets automatically when an event meets a global ignore rule's criteria. To learn more about [global ignore rules](./write-global-ignore-rules).
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Users can also set the event status to Not Important manually right. I think it would be nice to distinguish between False Positive and Not Important using an example to avoid any confusion

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

And do we include any more information around other times we automatically put it in Not Important status? We have a list in the code, but includes when the secret is in a test file, in a readme file, etc

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, there should be a corresponding tag in the event details when we automatically set it to Not Important


![Diagram showing the event workflow for Vault Radar](/img/docs/vault-radar/radar-event-state-workflow.png)

4 changes: 4 additions & 0 deletions content/hcp-docs/data/docs-nav-data.json
Original file line number Diff line number Diff line change
Expand Up @@ -944,6 +944,10 @@
{
"title": "Risk Severity",
"path": "vault-radar/manage/severity"
},
{
"title": "Event workflow and states",
"path": "vault-radar/manage/event-workflow"
},
{
"title": "Select event rules",
Expand Down
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading