Quartz 5

Lab: GHAS scans and remediation

Properties1
tagslab, az-400, ghas, codeql, dependabot, container-security

2 min read

Lab: GHAS scans and remediation

Outcome

Check GHAS eligibility in GitHub and Azure DevOps, generate safe code/dependency/container findings, triage ownership, remediate or document a time-bound exception, and observe the source-to-Defender path where licensed.

Do

  1. Record licensing, repository type, and feature prerequisites. Enable supported secret, dependency, and code scanning in a disposable GitHub repo and a supported Azure Repos code Git repository; do not claim Azure DevOps Server support where the current product excludes it.
  2. Add a harmless CodeQL-detectable training pattern or supported sample, run CodeQL, inspect SARIF/finding location, fix it, and verify closure. Build a disposable container image, scan it, set a severity gate, then correct the vulnerable package/base image or record a dated exception owner.
  3. Trigger a safe Dependabot alert/update PR, run tests, merge only after review, and verify the alert state. If the training tenant supports it, connect GHAS/DevOps Security to Defender for Cloud and trace the finding/recommendation without widening connector scope.

Verify

Capture eligibility, enabled features, findings, scan/gate output, remediation or exception, update PR/test, and Defender correlation when available. You should now understand: CodeQL analyzes code, dependency scanning analyzes components, container scanning analyzes images, and a finding requires ownership and a verified response.

Break and fix

  1. Enable an unavailable GHAS feature; diagnose licensing/platform/repository prerequisites rather than bypassing controls.
  2. Break CodeQL/container scan configuration or upload wrong SARIF; inspect workflow/pipeline logs, correct configuration, and rerun.
  3. Leave a Dependabot PR untested or exception unowned; add test evidence and expiration/owner before approval.

Scenario practice

  1. Configure: Select scans, gate threshold, ownership, exception expiry, and Defender connection scope.
  2. Diagnose: A code/container/dependency alert is missing or gate passes unexpectedly. Inspect feature enablement, workflow, image/tag, SARIF, severity filter, and repository eligibility.
  3. Distinguish: Contrast GHAS GitHub, GHAzDO, Defender DevOps Security, CodeQL, Dependabot, secret scanning, and container scanning.

Clean up

Delete test findings/images/repos/connectors or restore defaults; remove any temporary exception and test credentials.

Sources and re-audit

Re-audit when GHAS support, scanner configuration, or Defender integration changes.

github-advanced-security · static-analysis · dependabot-alerts · secret-scanning · All labs

Graph View

Backlinks