Catalog / GitHub

Public monitoring adds triage, validity, API, and webhooks

yesterdaysecurityaddedfixedOriginal notes

Public monitoring now includes alert management capabilities like automatic validity checks to help you triage and remediate leaked secrets at scale.

  • Alert management with dismissals, timelines, and filtering
  • Always-on validity checks for supported secret types
  • REST API and webhook support for public monitoring alerts

Alert management

Enterprises with public monitoring can now triage findings directly from the enterprise security dashboard:

  • Dismiss and reopen alerts: Close alerts as Dismissed or Fixed, provide an optional comment explaining the decision, or reopen closed alerts if circumstances change.
  • Activity timeline: Review an audit trail of all actions and state changes taken on an alert.
  • Filter and sort: Filter the alert list by repository, committer, secret type, attribution method (membership or verified domain), and state (i.e., open or closed) to focus on the exposures that matter most.

Closing an alert updates its state for your enterprise. It does not revoke the exposed credential or remove it from the public repository.

Always-on validity checks

Public monitoring now automatically checks token validity on an ongoing basis for supported providers. Alerts display whether a credential is Active, Inactive, or Unknown, allowing security teams to quickly prioritize response for live tokens.

REST API and webhook integration

Bring public monitoring findings into your custom incident response pipelines:

  • REST API: Enterprise admins and enterprise security managers can query attributed findings programmatically using GET /enterprises/{enterprise}/secret-scanning/public-monitoring-alerts. This returns alert metadata, secret type, attribution, and exposed locations.
  • Enterprise webhooks: Subscribe to the secret_scanning_public_monitoring_alert webhook event at the enterprise level to receive real-time notifications whenever a newly detected leak is attributed to your organization.

Eligibility and billing

Public monitoring remains available in public preview for GitHub Enterprise Cloud customers, including GitHub Enterprise Cloud with data residency. Enterprise admins and enterprise security managers can enable the feature and manage alert settings from the enterprise security dashboard.

Public monitoring is included with your GitHub Advanced Security or GitHub Secret Protection license at no additional cost.

Learn more

Learn more about public monitoring and join the discussion in the GitHub Community.

The post Public monitoring adds triage, validity, API, and webhooks appeared first on The GitHub Blog.