repo sync

content/code-security/security-overview/about-the-security-overview.md

@@ -1,6 +1,7 @@
 ---
 title: About the security overview
 intro: 'You can view, filter, and sort security alerts for repositories owned by your organization or team in one place: the Security Overview page.'
+permissions: Organization owners and security managers can access the security overview for organizations. Members of a team can see the security overview for repositories that the team has admin privileges for.
 product: '{% data reusables.gated-features.security-center %}'
 redirect_from:
   - /code-security/security-overview/exploring-security-alerts
@@ -23,13 +24,27 @@ shortTitle: About security overview
 
 ## About the security overview
 
-You can use the security overview for a high-level view of the security status of your organization or to identify problematic repositories that require intervention. At the organization-level, the security overview displays aggregate and repository-specific security information for repositories owned by your organization. At the team-level, the security overview displays repository-specific security information for repositories that the team has admin privileges for. For more information, see "[Managing team access to an organization repository](/organizations/managing-access-to-your-organizations-repositories/managing-team-access-to-an-organization-repository)."
+You can use the security overview for a high-level view of the security status of your organization or to identify problematic repositories that require intervention.
+
+- At the organization-level, the security overview displays aggregate and repository-specific security information for repositories owned by your organization.
+- At the team-level, the security overview displays repository-specific security information for repositories that the team has admin privileges for. For more information, see "[Managing team access to an organization repository](/organizations/managing-access-to-your-organizations-repositories/managing-team-access-to-an-organization-repository)."
+- At the repository-level, the security overview shows which security features are enabled for the repository, and offers the option to configure any available security features not currently in use.
 
 The security overview indicates whether {% ifversion fpt or ghes > 3.1 or ghec %}security{% endif %}{% ifversion ghae %}{% data variables.product.prodname_GH_advanced_security %}{% endif %} features are enabled for repositories owned by your organization and consolidates alerts for each feature.{% ifversion fpt or ghes > 3.1 or ghec %} Security features include {% data variables.product.prodname_GH_advanced_security %} features, such as {% data variables.product.prodname_code_scanning %} and {% data variables.product.prodname_secret_scanning %}, as well as {% data variables.product.prodname_dependabot_alerts %}.{% endif %} For more information about {% data variables.product.prodname_GH_advanced_security %} features, see "[About {% data variables.product.prodname_GH_advanced_security %}](/get-started/learning-about-github/about-github-advanced-security)."{% ifversion fpt or ghes > 3.1 or ghec %} For more information about {% data variables.product.prodname_dependabot_alerts %}, see "[About alerts for vulnerable dependencies](/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/about-alerts-for-vulnerable-dependencies#dependabot-alerts-for-vulnerable-dependencies)."{% endif %}
 
 For more information about securing your code at the repository and organization levels, see "[Securing your repository](/code-security/getting-started/securing-your-repository)" and "[Securing your organization](/code-security/getting-started/securing-your-organization)."
 
-In the security overview, you can view, sort, and filter alerts to understand the security risks in your organization and in specific repositories. You can apply multiple filters to focus on areas of interest. For example, you can identify private repositories that have a high number of {% data variables.product.prodname_dependabot_alerts %} or repositories that have no {% data variables.product.prodname_code_scanning %} alerts.
+The application security team at your company can use the security overview for both broad and specific analyses of your organization's security status. For example, they can use the overview page to monitor adoption of features by your organization or by a specific team as you rollout {% data variables.product.prodname_GH_advanced_security %} to your enterprise, or to review all alerts of a specific type and severity level across all repositories in your organization.
+
+### About filtering and sorting alerts
+
+In the security overview, you can view, sort, and filter alerts to understand the security risks in your organization and in specific repositories. The security summary is highly interactive, allowing you to investigate specific categories of information, based on qualifiers like alert risk level, alert type, and feature enablement. You can also apply multiple filters to focus on narrower areas of interest. For example, you can identify private repositories that have a high number of {% data variables.product.prodname_dependabot_alerts %} or repositories that have no {% data variables.product.prodname_code_scanning %} alerts. For more information, see "[Filtering alerts in the security overview](/code-security/security-overview/filtering-alerts-in-the-security-overview)."
+
+{% ifversion ghec or ghes > 3.4 %}
+
+In the security overview, at both the organization and repository level, there are dedicated views for specific security features, such as secret scanning alerts and code scanning alerts. You can use these views to limit your analysis to a specific set of alerts, and narrow the results further with a range of filters specific to each view. For example, in the secret scanning alert view, you can use the `Secret type` filter to view only secret scanning alerts for a specific secret, like a GitHub Personal Access Token. At the repository level, you can use the security overview to assess the specific repository's current security status, and configure any additional security features not yet in use on the repository.
+
+{% endif %}
 
 ![The security overview for an organization](/assets/images/help/organizations/security-overview.png)
 
@@ -45,94 +60,6 @@ For each repository in the security overview, you will see icons for each type o
 | {% octicon "check" aria-label="Check" %} | The security feature is enabled, but does not raise alerts in this repository. |
 | {% octicon "x" aria-label="x" %} | The security feature is not supported in this repository. |
 
-By default, archived repositories are excluded from the security overview for an organization. You can apply filters to view archived repositories in the security overview. For more information, see "[Filtering the list of alerts](#filtering-the-list-of-alerts)."
+By default, archived repositories are excluded from the security overview for an organization. You can apply filters to view archived repositories in the security overview. For more information, see "[Filtering alerts in the security overview](/code-security/security-overview/filtering-alerts-in-the-security-overview)."
 
 The security overview displays active alerts raised by security features. If there are no alerts in the security overview for a repository, undetected security vulnerabilities or code errors may still exist.
-
-## Viewing the security overview for an organization
-
-Organization owners can view the security overview for an organization.
-
-{% data reusables.organizations.navigate-to-org %}
-{% data reusables.organizations.security-overview %}
-1. To view aggregate information about alert types, click **Show more**.
-  ![Show more button](/assets/images/help/organizations/security-overview-show-more-button.png)
-{% data reusables.organizations.filter-security-overview %}
-
-## Viewing the security overview for a team
-
-Members of a team can see the security overview for repositories that the team has admin privileges for.
-
-{% data reusables.profile.access_org %}
-{% data reusables.user_settings.access_org %}
-{% data reusables.organizations.specific_team %}
-{% data reusables.organizations.team-security-overview %}
-{% data reusables.organizations.filter-security-overview %}
-
-## Filtering the list of alerts
-
-### Filter by level of risk for repositories
-
-The level of risk for a repository is determined by the number and severity of alerts from security features. If one or more security features are not enabled for a repository, the repository will have an unknown level of risk. If a repository has no risks that are detected by security features, the repository will have a clear level of risk.
-
-| Qualifier | Description |
-| -------- | -------- |
-| `risk:high` | Display repositories that are at high risk. |
-| `risk:medium` | Display repositories that are at medium risk. |
-| `risk:low` | Display repositories that are at low risk. |
-| `risk:unknown` | Display repositories that are at an unknown level of risk. |
-| `risk:clear` | Display repositories that have no detected level of risk. |
-
-### Filter by number of alerts
-
-| Qualifier | Description |
-| -------- | -------- |
-| <code>code-scanning-alerts:<em>n</em></code> | Display repositories that have *n* {% data variables.product.prodname_code_scanning %} alerts. This qualifier can use &gt and &lt comparison operators. |
-| <code>secret-scanning-alerts:<em>n</em></code> | Display repositories that have *n* {% data variables.product.prodname_secret_scanning %} alerts. This qualifier can use &gt and &lt comparison operators. |
-| <code>dependabot-alerts:<em>n</em></code> | Display repositories that have *n* {% data variables.product.prodname_dependabot_alerts %}. This qualifier can use &gt and &lt comparison operators. |
-
-### Filter by whether security features are enabled
-
-| Qualifier | Description |
-| -------- | -------- |
-| `enabled:code-scanning` | Display repositories that have {% data variables.product.prodname_code_scanning %} enabled. |
-| `not-enabled:code-scanning` | Display repositories that do not have {% data variables.product.prodname_code_scanning %} enabled. |
-| `enabled:secret-scanning` | Display repositories that have {% data variables.product.prodname_secret_scanning %} enabled. |
-| `not-enabled:secret-scanning` | Display repositories that have {% data variables.product.prodname_secret_scanning %} enabled. |
-| `enabled:dependabot-alerts` | Display repositories that have {% data variables.product.prodname_dependabot_alerts %} enabled. |
-| `not-enabled:dependabot-alerts` | Display repositories that do not have {% data variables.product.prodname_dependabot_alerts %} enabled. |
-
-### Filter by repository type
-
-| Qualifier | Description |
-| -------- | -------- |
-{%- ifversion fpt or ghes > 3.1 or ghec %}
-| `is:public` | Display public repositories. |
-{% elsif ghes or ghec or ghae %}
-| `is:internal` | Display internal repositories. |
-{%- endif %}
-| `is:private` | Display private repositories. |
-| `archived:true` | Display archived repositories. |
-| `archived:true` | Display archived repositories. |
-
-### Filter by team
-
-| Qualifier | Description |
-| -------- | -------- |
-| <code>team:<em>TEAM-NAME</em></code> | Displays repositories that *TEAM-NAME* has admin privileges for. |
-
-### Filter by topic
-
-| Qualifier | Description |
-| -------- | -------- |
-| <code>topic:<em>TOPIC-NAME</em></code> | Displays repositories that are classified with *TOPIC-NAME*. |
-
-### Sort the list of alerts
-
-| Qualifier | Description |
-| -------- | -------- |
-| `sort:risk` | Sorts the repositories in your security overview by risk. |
-| `sort:repos` | Sorts the repositories in your security overview alphabetically by name. |
-| `sort:code-scanning-alerts` | Sorts the repositories in your security overview by number of {% data variables.product.prodname_code_scanning %} alerts. |
-| `sort:secret-scanning-alerts` | Sorts the repositories in your security overview by number of {% data variables.product.prodname_secret_scanning %} alerts. |
-| `sort:dependabot-alerts` | Sorts the repositories in your security overview by number of {% data variables.product.prodname_dependabot_alerts %}. |

content/code-security/security-overview/filtering-alerts-in-the-security-overview.md

@@ -0,0 +1,136 @@
+---
+title: Filtering alerts in the security overview
+intro: 'Use filters to view specific categories of alerts'
+permissions: Organization owners and security managers can access the security overview for organizations. Members of a team can see the security overview for repositories that the team has admin privileges for.
+product: '{% data reusables.gated-features.security-center %}'
+versions:
+  fpt: '*'
+  ghes: '>3.1'
+  ghec: '*'
+type: how_to
+topics:
+  - Security overview
+  - Advanced Security
+  - Alerts
+  - Organizations
+  - Teams
+shortTitle: Filtering alerts
+---
+
+{% data reusables.security-center.beta %}
+
+## About filtering the security overview
+
+You can use filters in the security overview to narrow your focus based on a range of factors, like alert risk level, alert type and feature enablement. Different filters are available depending on the specific view and whether you analysing at the organization, team or repository level.
+
+## Filter by repository
+
+Available in all organization-level and team-level views.
+
+| Qualifier | Description |
+| -------- | -------- |
+| `repo:REPOSITORY-NAME` | Displays alerts for the specified repository. |
+
+## Filter by whether security features are enabled
+
+Available in the organization-level and team-level overview.
+
+| Qualifier | Description |
+| -------- | -------- |
+| `code-scanning:enabled` | Display repositories that have {% data variables.product.prodname_code_scanning %} enabled. |
+| `code-scanning:not-enabled` | Display repositories that do not have {% data variables.product.prodname_code_scanning %} enabled. |
+| `secret-scanning:enabled` | Display repositories that have {% data variables.product.prodname_secret_scanning %} enabled. |
+| `secret-scanning:not-enabled` | Display repositories that have {% data variables.product.prodname_secret_scanning %} enabled. |
+| `dependabot:enabled` | Display repositories that have {% data variables.product.prodname_dependabot_alerts %} enabled. |
+| `dependabot:not-enabled` | Display repositories that do not have {% data variables.product.prodname_dependabot_alerts %} enabled. |
+| `not-enabled:any` | Display repositories with at least one security feature that is not enabled. |
+
+## Filter by repository type
+
+Available in the organization-level and team-level overview.
+
+| Qualifier | Description |
+| -------- | -------- |
+{%- ifversion fpt or ghes or ghec %}
+| `is:public` | Display public repositories. |
+{%- endif %}
+{%- ifversion ghes or ghec or ghae %}
+| `is:internal` | Display internal repositories. |
+{%- endif %}
+| `is:private` | Display private repositories. |
+| `archived:true` | Display archived repositories. |
+| `archived:true` | Display archived repositories. |
+
+## Filter by level of risk for repositories
+
+The level of risk for a repository is determined by the number and severity of alerts from security features. If one or more security features are not enabled for a repository, the repository will have an unknown level of risk. If a repository has no risks that are detected by security features, the repository will have a clear level of risk. Available in the organization-level overview.
+
+| Qualifier | Description |
+| -------- | -------- |
+| `risk:high` | Display repositories that are at high risk. |
+| `risk:medium` | Display repositories that are at medium risk. |
+| `risk:low` | Display repositories that are at low risk. |
+| `risk:unknown` | Display repositories that are at an unknown level of risk. |
+| `risk:clear` | Display repositories that have no detected level of risk. |
+
+## Filter by number of alerts
+
+Available in the organization-level overview.
+
+| Qualifier | Description |
+| -------- | -------- |
+| <code>code-scanning:<em>n</em></code> | Display repositories that have *n* {% data variables.product.prodname_code_scanning %} alerts. This qualifier can use `=`, `>` and `<` comparison operators. |
+| <code>secret-scanning:<em>n</em></code> | Display repositories that have *n* {% data variables.product.prodname_secret_scanning %} alerts. This qualifier can use `=`, `>` and `<` comparison operators. |
+| <code>dependabot:<em>n</em></code> | Display repositories that have *n* {% data variables.product.prodname_dependabot_alerts %}. This qualifier can use `=`, `>` and `<` comparison operators. |
+
+
+## Filter by team
+
+Available in the organization-level overview.
+
+| Qualifier | Description |
+| -------- | -------- |
+| <code>team:<em>TEAM-NAME</em></code> | Displays repositories that *TEAM-NAME* has admin privileges for. |
+
+## Filter by topic
+
+Available in the organization-level overview.
+
+| Qualifier | Description |
+| -------- | -------- |
+| <code>topic:<em>TOPIC-NAME</em></code> | Displays repositories that are classified with *TOPIC-NAME*. |
+
+{% ifversion ghec or ghes > 3.4 %}
+
+## Filter by severity
+
+Available in the code scanning alert views. All code scanning alerts have one of the categories shown below. You can click any result to see full details of the relevant rule, and the line of code that triggered the alert. 
+
+| Qualifier | Description |
+| -------- | -------- |
+|`severity:critical`|Displays {% data variables.product.prodname_code_scanning %} alerts categorized as critical.|
+|`severity:high`|Displays {% data variables.product.prodname_code_scanning %} alerts categorized as high.|
+|`severity:medium`|Displays {% data variables.product.prodname_code_scanning %} alerts categorized as medium.|
+|`severity:low`|Displays {% data variables.product.prodname_code_scanning %} alerts categorized as low.|
+|`severity:error`|Displays {% data variables.product.prodname_code_scanning %} alerts categorized as errors.|
+|`severity:warning`|Displays {% data variables.product.prodname_code_scanning %} alerts categorized as warnings.|
+|`severity:note`|Displays {% data variables.product.prodname_code_scanning %} alerts categorized as notes.|
+
+{% endif %}
+
+## Filter by secret types
+
+Available in the secret scanning alert views.
+
+| Qualifier | Description |
+| -------- | -------- |
+| `secret-type:SERVICE_PROVIDER` | Displays alerts for the specified secret and provider. For more information, see "[List of supported secrets for private repositories](/code-security/secret-scanning/about-secret-scanning#list-of-supported-secrets-for-private-repositories) |
+| `secret-type:CUSTOM-PATTERN` | Displays alerts for secrets matching the specified custom pattern. For more information, see "[Defining custom patterns for secret scanning](/code-security/secret-scanning/defining-custom-patterns-for-secret-scanning)." |
+
+## Filter by provider
+
+Available in the secret scanning alert views.
+
+| Qualifier | Description |
+| -------- | -------- |
+|`provider:PROVIDER_NAME` | Displays alerts for all secrets issues by the specified provider. For more information, see "[List of supported secrets for private repositories](/code-security/secret-scanning/about-secret-scanning#list-of-supported-secrets-for-private-repositories) |

content/code-security/security-overview/index.md

@@ -13,5 +13,6 @@ topics:
   - Advanced Security
 children:
   - /about-the-security-overview
+  - /viewing-the-security-overview
+  - /filtering-alerts-in-the-security-overview
 ---
-