You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: content/code-security/reference/security-at-scale/overview-dashboard-metrics.md
+64-87Lines changed: 64 additions & 87 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -16,172 +16,149 @@ redirect_from:
16
16
17
17
## Dashboard metrics
18
18
19
-
The overview dashboard of security overview displays security alert metrics for your organization{% ifversion security-overview-dashboard-enterprise %} or enterprise{% endif %}.
19
+
In security overview, the overview dashboard displays security alert metrics for your organization{% ifversion security-overview-dashboard-enterprise %} or enterprise{% endif %}. You can use the dashboard to monitor the health of your application security program, collaborate with engineering teams, and gather data for benchmarking purposes.
20
+
21
+
The dashboard displays trending data that tracks alert counts and activity over time, as well as snapshot data that reflects the current state. All data and metrics across the dashboard change as you apply filters. By default, the dashboard displays all alerts from {% data variables.product.prodname_dotcom %} tools, but you can use the tool filter to show alerts from a specific tool ({% data variables.product.prodname_secret_scanning %}, {% data variables.product.prodname_dependabot %}, {% data variables.product.prodname_code_scanning %} using {% data variables.product.prodname_codeql %}, a specific third-party tool) or all third-party {% data variables.product.prodname_code_scanning %} tools. See [AUTOTITLE](/code-security/security-overview/filtering-alerts-in-security-overview).
20
22
21
23
**Trend indicators** show percentage change compared to the previous period. For example:
22
24
* 10 alerts this week vs. 20 alerts last week = 50% decrease
23
25
* An average alert age of 15 days vs. 5 days = 200% increase
24
26
25
27
**Alert severity filtering:** The dashboard only includes alerts with security severity levels: `Critical`, `High`, `Medium`, or `Low`. Non-security alerts (`Error`, `Warning`, or `Note`) are excluded. This may cause the dashboard count to differ from {% data variables.product.prodname_code_scanning %} alert totals. For more information, see [AUTOTITLE](/code-security/code-scanning/managing-code-scanning-alerts/about-code-scanning-alerts#about-alert-severity-and-security-severity-levels).
26
28
29
+
### Limitations
30
+
31
+
The data that populates the overview page can and will change over time due to various factors, such as repository deletion or modifications to a security advisory. This means that the overview metrics for the same time period could vary if viewed at two different times. For compliance reports or other scenarios where data consistency is crucial, we recommend that you source data from the audit log. See [AUTOTITLE](/code-security/getting-started/auditing-security-alerts).
32
+
33
+
The overview page tracks how security alerts changed over time. However, when you filter by another attribute, such as repository status, it uses that attribute's current value, not its historical value.
34
+
35
+
For example, archiving a repository closes any open alerts it contains. If you view the overview page for a week before you archived the repository:
36
+
37
+
* The repository's data only appears if you filter to show archived repositories, because that's the repository's current status.
38
+
* The alerts still show up as open, because that reflects their status at that point in time.
39
+
27
40
<!--Content for FPT, GHEC, and GHES 3.16+ see next HTML comment for GHES <= 3.15-->
28
41
29
42
## Dashboard structure
30
43
31
-
The **Detection** tab includes information on:
32
-
* Alert status and age
33
-
* Secrets blocked or bypassed
34
-
* High-risk repositories and vulnerabilities
44
+
The dashboard is divided into three tabs, each focused around a different security goal:
35
45
36
-
The**Remediation**tab includes information on:
37
-
*How alerts are resolved
38
-
*Alert activity over time
46
+
***Detection:**Shows metrics about the status and age of alerts in your organization{% ifversion security-overview-dashboard-enterprise %} or enterprise{% endif %}, the secrets that have been blocked or bypassed, and the top repositories and vulnerabilities that pose the highest potential security risk.
47
+
***Remediation:** Shows metrics about how alerts are resolved and alert activity over time.
48
+
***Prevention:** Shows metrics about how vulnerabilities have been prevented and fixed in pull requests.
39
49
40
-
The **Prevention** tab includes information on:
41
-
* Vulnerabilities prevented and fixed in pull requests
42
-
* {% data variables.product.prodname_codeql %} alerts in merged pull requests (not on the default branch)
50
+
> [!NOTE]
51
+
> Unlike the **Detection** and **Remediation** tabs which report alerts on the default branch, the **Prevention** tab gives you insights for {% data variables.product.prodname_codeql %} alerts found in merged pull requests.
43
52
44
53
## Detection metrics
45
54
46
-
Track the current state of security alerts.
55
+
Track the current state of security alerts in your organization{% ifversion security-overview-dashboard-enterprise %} or enterprise{% endif %}.
47
56
48
57
### Open alerts over time
49
58
50
-
Shows the number of open alerts over time.
51
-
52
-
**Included**
53
-
* New alerts (shown on creation date)
54
-
* Existing open alerts (shown at start of period)
55
-
56
-
**Excluded**
57
-
* Remediated or dismissed alerts
59
+
Shows the change in the number of open alerts over the time period you have chosen. By default, alerts are grouped by severity. You can change the way alerts are grouped.
58
60
59
-
**Default grouping:** Alert severity
61
+
* New alerts are represented on their creation date.
62
+
* Alerts that existed before the chosen time period are represented at the start of the period.
63
+
* Once an alert is remediated or dismissed, it is not included in the graph. Instead, the alert moves to the closed alerts graph.
60
64
61
65
### Age of alerts
62
66
63
-
Average age of alerts still open at the end of the time period.
67
+
The average age of all alerts that are still open at the end of the chosen time period.
64
68
65
-
**Formula:**(Period end date - Alert creation date) averaged across all open alerts
69
+
**Formula:**The age of each open alert is calculated by subtracting the date the alert was created from the date that the chosen time period ends, then averaging across all open alerts.
66
70
67
-
**Note:** Reopened alerts use the original creation date, not the reopen date
71
+
> [!NOTE]
72
+
> For reopened alerts, the age is calculated by subtracting the original creation date rather than the date the alert was reopened.
68
73
69
74
### Reopened alerts
70
75
71
-
Total open alerts that were reopened during the time period.
76
+
The total number of open alerts that were reopened during the chosen time period. Only alerts that are open at the end of the reporting period are reported. This includes:
72
77
73
-
**Counted if:**
74
-
* Closed before the period and still open at period end
75
-
* Created, closed, and reopened during the period
76
-
* Open at period start, closed, then reopened during the period
77
-
78
-
**Requirement:** Must be open at the end of the reporting period.
78
+
* Alerts that were closed before the chosen time period and remain open at the end of the period.
79
+
* Newly created alerts that were closed and then reopened during the chosen time period.
80
+
* Alerts that were open at the start of the chosen time period, but closed and then reopened within the same period.
79
81
80
82
### Secrets bypassed or blocked
81
83
82
-
Ratio of secrets bypassed to total secrets blocked by push protection.
84
+
Shows the ratio of secrets bypassed to the total secrets blocked by push protection.
83
85
84
-
**Metrics**
85
-
***Bypassed:** Detected secrets that were committed anyway
86
-
***Successfully blocked:** Total blocked minus bypassed
86
+
***Bypassed:** Detected secrets that were committed anyway.
87
+
***Successfully blocked:** Total blocked minus bypassed. A secret is considered to have been successfully blocked when it has been corrected and not committed to the repository.
87
88
88
-
**View details:**Click to see the {% data variables.product.prodname_secret_scanning %} report with matching filters.
89
+
Click **View details** to view the {% data variables.product.prodname_secret_scanning %} report with the same filters and time period selected.
89
90
90
-
For more information, see [AUTOTITLE](/code-security/security-overview/viewing-metrics-for-secret-scanning-push-protection).
91
+
For more information on {% data variables.product.prodname_secret_scanning %} push protection metrics, see [AUTOTITLE](/code-security/security-overview/viewing-metrics-for-secret-scanning-push-protection).
91
92
92
93
### Impact analysis table
93
94
94
-
Shows repositories and vulnerabilities with the highest security risk.
95
-
96
-
**Repositories tab**
97
-
* Top 10 repositories by open alert count
98
-
* Total alerts and severity breakdown
95
+
The impact analysis table has separate tabs showing data for: "Repositories," "Advisories," and "SAST vulnerabilities."
99
96
100
-
**Advisories tab**
101
-
* Top 10 CVE advisories by alert count
102
-
* {% data variables.product.prodname_dependabot %} alerts only
103
-
104
-
**SAST vulnerabilities tab**
105
-
* Top 10 Static Application Security Testing (SAST) vulnerabilities
106
-
* {% data variables.product.prodname_dependabot_alerts %} only
97
+
***Repositories tab:** Shows the top 10 repositories with the most open alerts at the end of the chosen time period, ranked by total number of open alerts. For each repository, the total number of open alerts is shown alongside a breakdown by severity.
98
+
***Advisories tab:** Shows the 10 CVE advisories that triggered the most {% data variables.product.prodname_dependabot %} alerts at the end of the chosen time period, ranked by total number of open alerts. For each advisory, the total number of open alerts is shown alongside a severity rating.
99
+
***SAST vulnerabilities tab:** Shows the 10 Static Application Security Testing (SAST) vulnerabilities that triggered the most {% data variables.product.prodname_code_scanning %} alerts, ranked by total number of open alerts. For each vulnerability, the total number of open alerts is shown alongside a severity rating.
107
100
108
101
## Remediation metrics
109
102
110
103
Track how quickly and effectively alerts are resolved.
111
104
112
105
### Closed alerts over time
113
106
114
-
Graph showing the number of closed alerts over time.
115
-
116
-
**Included**
117
-
* Alerts closed during period (shown on close date)
118
-
* Alerts closed before period (shown at start of period)
107
+
Shows the change in the number of closed alerts over the time period you have chosen. By default, alerts are grouped by severity. You can change the way alerts are grouped. Closed alerts include security alerts that have been successfully remediated or dismissed prior to or during the chosen time period.
119
108
120
-
**Default grouping:** Alert severity
109
+
* Alerts closed during the time period are represented on the graph on their close date.
110
+
* Alerts remediated or dismissed before the chosen time period are represented at the start of the period.
121
111
122
112
### Mean time to remediate
123
113
124
-
Average age of alerts remediated or dismissed during the time period.
114
+
The average age of all alerts that were remediated or dismissed during the chosen time period. Alerts that were closed as "false positive" are excluded.
125
115
126
-
**Formula:**(Alert close date - Alert creation date) averaged across all closed alerts
116
+
**Formula:**The age of each closed alert is calculated by subtracting the date the alert was created from the date that the alert was last closed during the chosen time period, then averaging across all closed alerts.
127
117
128
-
**Excluded:** Alerts closed as "false positive"
129
-
130
-
>[!NOTE]
131
-
> Reopened alerts use the original creation date, not the reopen date.
118
+
> [!NOTE]
119
+
> For reopened alerts, the age is calculated by subtracting the original creation date rather than the date the alert was reopened.
132
120
133
121
### Net resolve rate
134
122
135
-
Rate at which alerts are being closed (measures resolution velocity).
123
+
The rate at which alerts are being closed. This metric is similar to measuring "developer velocity," reflecting the speed and efficiency with which alerts are resolved.
136
124
137
-
**Formula:**Closed alerts (that stayed closed) ÷ New alerts created
125
+
**Formula:**Number of alerts that were closed and remained closed during the chosen time period ÷ Number of alerts created during the time period
138
126
139
-
**Important:** Uses all new and closed alerts in the period. These may be different alert populations.
127
+
> [!NOTE]
128
+
> The net resolve rate takes into account any new and any closed alerts during the chosen time period. This means that the set of new alerts and set of closed alerts used for the calculation do not necessarily correspond, since they may represent different populations of alerts.
140
129
141
-
**Excluded:** Alerts reopened and re-closed during the period.
130
+
**Excluded:** Alerts that are reopened and re-closed during the chosen time period are ignored.
142
131
143
132
### Alert activity graph
144
133
145
-
Shows alert inflows and outflows over time.
134
+
Shows alert inflows and outflows over your chosen time period.
146
135
147
-
**Visual key**
148
-
***Green bars:** New alerts created
149
-
***Purple bars:** Alerts closed
150
-
***Blue line:** Net activity (new minus closed)
136
+
***Green bars:** Number of new alerts created during the segmented time period
137
+
***Purple bars:** Number of alerts closed during the segmented time period
138
+
***Blue dotted line:** Net alert activity (difference between new and closed alerts)
151
139
152
140
## Prevention metrics
153
141
154
142
Track vulnerabilities caught and fixed before reaching production.
155
143
156
-
**Data source:** {% data variables.product.prodname_codeql %} alerts in merged pull requests (not on the default branch)
157
-
158
144
### Introduced versus prevented
159
145
160
-
Cumulative vulnerabilities caught versus introduced.
146
+
Shows the cumulative number of vulnerabilities that were caught in the developer workflow versus the vulnerabilities introduced over the time period you have chosen.
161
147
162
-
**Prevented**
163
-
* Pull request alerts fixed before merge
164
-
* Detected by {% data variables.product.prodname_codeql %}
165
-
* Dates based on fix date
166
-
167
-
**Introduced**
168
-
* New pull request alerts dismissed as "Risk accepted" or unresolved at merge
169
-
* Detected by {% data variables.product.prodname_codeql %}
170
-
* Dates based on creation date
148
+
***Prevented:** Count of pull request alerts detected by {% data variables.product.prodname_codeql %} that have been fixed for merged pull requests. Dates are based on fix date.
149
+
***Introduced:** Count of new pull request alerts detected by {% data variables.product.prodname_codeql %} that were dismissed as "Risk accepted" or were unresolved at the time the pull request was merged. Dates are based on creation date.
171
150
172
151
### Vulnerabilities fixed in pull requests
173
152
174
-
Count of pull request alerts with close reason "Fixed" in merged pull requests.
175
-
176
-
**Alert types:** {% data variables.product.prodname_codeql %} or {% data variables.product.prodname_secret_scanning %}
153
+
The count of pull request alerts detected by {% data variables.product.prodname_codeql %} or {% data variables.product.prodname_secret_scanning %} with a close reason of "Fixed" that are tied to a merged pull request.
177
154
178
155
{% ifversion code-scanning-autofix %}
179
156
180
157
### Pull request alerts fixed with {% data variables.copilot.copilot_autofix_short %} suggestions
181
158
182
-
Ratio of accepted to total {% data variables.copilot.copilot_autofix_short %} suggestions on pull request alerts.
159
+
Shows the ratio of accepted {% data variables.copilot.copilot_autofix_short %} suggestions to the total number of {% data variables.copilot.copilot_autofix_short %} suggestions on pull request alerts detected by {% data variables.product.prodname_code_scanning %}.
183
160
184
-
**{% data variables.copilot.copilot_autofix_short %}**provides targeted fix recommendations for {% data variables.product.prodname_code_scanning %} alerts. For more information, see[AUTOTITLE](/code-security/code-scanning/managing-code-scanning-alerts/responsible-use-autofix-code-scanning).
161
+
{% data variables.copilot.copilot_autofix_short %} for {% data variables.product.prodname_code_scanning %} provides targeted recommendations to help you fix {% data variables.product.prodname_code_scanning %} alerts. See[AUTOTITLE](/code-security/code-scanning/managing-code-scanning-alerts/responsible-use-autofix-code-scanning).
0 commit comments