Home / News & insights / Product

Introducing auto-triage rules for Dependabot

Make quick work of alerts with preset and custom rules.

&
| 4 minutes

Since the May beta release of our GitHub-curated Dependabot policies that detect and close false positive alerts, over 250k repositories have manually opted in, with an average improvement of over 1 in 10 alerts. The impact so far: auto-dismissal of millions of alerts that would have otherwise demanded a developer’s attention to manually assess and triage.

Starting today, you can create your own custom rules to control how Dependabot auto-dismisses and reopens alerts, so you can focus on the alerts that matter without worrying about the alerts that don’t. Today’s ship—our public beta of custom auto-triage rules—makes that engine available for everyone, so you can specify and delegate specific decision making tasks to Dependabot with your own custom rules.

Today’s release is part of a series of ships that make it easier to scale your security strategy, whether you’re an open source maintainer or an application developer on a centralized security team. Custom auto-triage rules for Dependabot are free for public repositories and available as part of GitHub Advanced Security for private repositories. Together with auto-triage presets and a renewed investment in alert metadata, custom auto-triage rules relieve developers from the overhead of alert management tasks so they can focus on creating great code.

What are auto-triage rules?

Auto-triage rules are a powerful tool to help you reduce false positives and alert fatigue substantially, while better managing your alerts at scale.

Rules contain criteria that match the targeted alerts, plus the decision that Dependabot will perform on your behalf.

From the rules list view, you can manage GitHub-curated presets and create your own custom rules to auto-triage alerts.

What behaviors can Dependabot perform?

For any existing or future alerts that match a custom rule, Dependabot will perform the selected behavior accordingly.

Example auto-triage rule that snoozes matching alerts until a patch is available.

Our first public beta release covers ignore and snooze-until-patch functionality with repository-level rules. We will follow-up soon with support for managing rules at the organization-level.

Both are managed via the auto-dismiss alert resolution, which provides visibility into automated decisions, integrates with existing reporting systems and workflows, and ensures that alerts can be reintroduced if alert metadata changes.

What alert criteria are supported by custom rules?

Custom rules can target alerts based on multiple criteria, including the below attributes as of today.

Custom rules can be created across stackable attributes related to dependencies and the advisory.

Attribute Description
severity Alert severity, based on CVSS base score, across the following values: low, medium, high, and critical.
scope Scope of the dependency: development (devDependency) or runtime (production).
package-name Packages, listed by package name.
cwe CWEs, listed by CWE ID.
ecosystem Ecosystems, listed by ecosystem name.
manifest Manifest files, listed by manifest path.

Who can use this feature?

GitHub-curated presets–such as auto-dismissal of false positives–are free for everyone and on all repositories. Custom auto-triage rules are available for free on all public repositories, and available as a feature of GitHub Advanced Security for private repositories.

Read our collection of posts to learn more about GitHub Advanced Security.

What’s next for Dependabot?

In addition to gathering your feedback during the public beta, we’re working to support additional alert metadata and enforcement options to expand the capabilities of custom rules. We’re also working on new configurability options for Dependabot security updates to give you more control over remediation flows. Keep an eye on the GitHub Changelog for more!

In the meantime, try out Dependabot’s new auto-triage functionality and let us know what you think–we’re listening.

Learn more:

Tags:

Written by

Related posts