Triage secrets findings in Semgrep AppSec Platform
After each scan, your findings are displayed in Semgrep AppSec Platform's Secrets page. The filters provided allow you to manage and triage your findings.
Findings from local scans are differentiated from their remote counterparts through their slugs. Remote repositories are identified as ACCOUNT_NAME/REPOSITORY_NAME, while local repositories are identified as local_scan/REPOSITORY_NAME.
Default Secrets page view and branch logic
In Semgrep, a single finding may appear in several branches. These appearances are called instances of a finding. In Semgrep Secrets, the latest instance, or the finding from the most recent branch scanned, is displayed by default. This is because, if a Secrets finding is present in any branch, even a non-primary (default) branch, it is considered valid.
Triage findings
You can triage secrets-related findings in Semgrep AppSec Platform on the Secrets page. By default, all findings are displayed. A common triage workflow includes the following tasks:
- Filtering for a particular characteristic of a finding, such as its Validation status, Repository or Branch, or Type.
- Analyzing if the findings are true or false positives.
- Applying a triage state to the filtered findings based on the analysis in step 2.
- Setting a finding as Ignored means that no action is undertaken and the finding is closed. Subsequent scans won't include this finding.
- Setting or retaining a finding as Open means that the finding is a true positive and needs to be fixed or resolved.
- Optional: You can create a ticket for Linear, Jira, or Asana to assign a developer to fix Open findings.
When commits are added to the PR or MR, Semgrep re-scans the PR or MR and detects if a finding is fixed. The finding is resolved automatically upon scanning. Users do not need to set a finding as Fixed manually.
Common filtering use cases
You can find and perform bulk operations through filtering; all filter operations are available to you on the Secrets page.
| Task | Steps |
|---|---|
| Viewing valid findings | Under Validation, click ⚠️Confirmed valid. |
| View findings in a specific project or branch | 1. Under Projects, select a repository from the drop-down menu. 2. Under Branches, select a branch from the drop-down menu. |
| View findings of a specific type of secret, such as personal token or password. | Under Type, select a type of secret. |
| View findings of a specific severity | Under Severity, select a value. |
Figure. Secrets page and relevant triaging elements: (a) All available filters; (b) Bulk selection toggle; (c) Bulk triage button.
You can triage findings in bulk by performing the following steps:
- Begin by ensuring that you display all Open findings.
- Apply filters with as much specificity as possible. You may have to perform bulk triage several times. By starting with the most specific cases, and closing the findings from those specific cases, you are able to narrow down findings as you work from specific to broad filter criteria.
- Click the bulk select check ox.
- Click Triage, then your selected triage state, typically Ignore.
- Optional: Repeat this procedure to triage all open findings.
Receive findings in through PR and MR comments
In addition to viewing your results in Semgrep AppSec Platform, you can set up PR or MR comments from Semgrep, which allows you to view findings-related information directly in your pull requests and merge requests.
To receive PR or MR comments, ensure that:
- You have set up comments as part of your core deployment.
- You have defined which rules should be in Allow, Comment, or Block mode in the Policies page.
Figure. Semgrep Secrets finding in a PR comment.
Define which rules should be in allow, comment, or block mode in the Policies page.
Not finding what you need in this doc? Ask questions in our Community Slack group, or see Support for other ways to get help.