-
Notifications
You must be signed in to change notification settings - Fork 1.9k
Crypto: Alert fatigue remediation (legacy queries) #20566
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Crypto: Alert fatigue remediation (legacy queries) #20566
Conversation
…arms when converted into SARIF for GH Code Scanning output panes.
… alarms when converted into SARIF for GH Code Scanning output panes.
|
@nicolaswill , I think I used the error severity out of habit here. Is the official policy to use "Recommended" for queries like this? |
I don't know of any 'official' policy, but when testing the difference is between 'errors' and 'lots of red' on the GUI, and 'Notes' the comprise the CBOM. Finding an instance of 'SHA512' is not an error, it's just a discovery. Most scanners (Nessus, Qualys, etc) have an 'info' category for this purpose, so extending the logic to differentiate queries that are indicating something is wrong (an 'error') and queries that indicate something is 'part of a CBOM'. This can be ignored, but it's something that hinders uptake where I am. |
Yea I agree. We want something for 'info' for our use as well, but I'm unaware of any equivalent currently or what they recommend using as an alternative. I assume "recommended" is the alternative but maybe @nicolaswill would know? |
|
I have not yet reviewed this PR but will note that these changes target the outdated / legacy cryptography models and queries that we are aiming to replace with the new models under the |

When these queries are used in conjunction with the advanced security codeql action it generates lots of alerts in the Security -> Code Scanning pane.
This is fine for issues, such as 'Weak Hashes' etc, but it's problematic for the CBOM stuff as it'll either push it to not be used because it generates alerts where there is not necessarily a problem, or that it will cause issues by influencing the number of errors coming out of a CodeQL analysis.
To this end, we've changed up the
@problem.severity errorfor@severity recommendationin the existing queries for C/C++/python.