Skip to content

docs(connectors): document GitHub issue import on the GHAS connector - #15755

Merged
Maffooch merged 1 commit into
DefectDojo:devfrom
devGregA:sc-14723_github_issues_docs
Aug 21, 2026
Merged

docs(connectors): document GitHub issue import on the GHAS connector#15755
Maffooch merged 1 commit into
DefectDojo:devfrom
devGregA:sc-14723_github_issues_docs

Conversation

@devGregA

Copy link
Copy Markdown
Contributor

Documents GitHub issue import on the GitHub Advanced Security connector, which can now read a repository's issue tracker as a fourth finding type (GitHub:Issues) alongside the code scanning, Dependabot and secret scanning alert families.

Issues are ordinary tracker entries rather than scanner output — GitHub attaches no severity, CWE or CVE to them — so two settings decide what is imported and how it is scored, and the docs explain both:

  • Issue Labels is the filter. An issue must carry every label listed, since GitHub combines them with AND rather than OR, which is the detail most likely to cause a silently empty import.
  • Issue Severity Labels maps a repository's own labels onto DefectDojo severities. Left blank, labels that are already severity names are matched as they are.
  • Default Issue Severity covers whatever the map does not recognize.

Both are blank by default and nothing is imported until a label is set, so an existing connector is unaffected.

Also documents the token permission issues need, which is less than the alert families require and does not depend on Advanced Security being enabled for the repository at all.

The last section covers the behaviours people are most likely to be caught out by:

  • Pull requests are never imported, even though GitHub returns them from the same endpoint as issues.
  • Closing an issue closes the finding; reopening it reopens the same one.
  • The issue body is reproduced verbatim as the finding description, so anything written in an issue reaches DefectDojo.
  • These findings carry no CWE, CVE, component or file path, so they will not deduplicate or correlate against scanner findings for the same problem.
  • A repository with its issue tracker disabled is skipped rather than reported empty, so turning issues off does not close findings already imported from it.

English only. The four translated tool references are updated by their own pass — three of the last four changes to this page followed the same pattern.

The GitHub Advanced Security connector can now import a repository's issue
tracker as a fourth finding type, GitHub:Issues, alongside the code scanning,
Dependabot and secret scanning alert families.

Documents the two settings that drive it -- Issue Labels as the filter, Issue
Severity Labels as the label-to-severity map, and Default Issue Severity for
whatever the map does not match -- plus the token permission issues need, which
is less than the alert families require and does not depend on Advanced
Security being enabled at all.

Adds a "what to expect" section covering the parts that surprise people: pull
requests are never imported even though GitHub returns them from the issues
endpoint, closing an issue closes the finding, the issue body is reproduced
verbatim as the description, and these findings carry no CWE, CVE or component
so they will not deduplicate against scanner findings for the same problem.

English only; the translated tool references are updated by their own pass.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
@github-actions github-actions Bot added the docs label Aug 20, 2026
@Maffooch Maffooch added this to the 3.3.0 milestone Aug 21, 2026
@Maffooch
Maffooch merged commit 8f9f527 into DefectDojo:dev Aug 21, 2026
22 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants