Creación y administración de campañas de seguridad

Creating a security campaign

Security campaigns are created and managed from the Security tab for your organization.

You choose the alerts that you want to include in the campaign by using either:

• Campaign templates: Campaign templates contain filters for the most common alert selections. They also all include the requirement that GitHub Copilot Autofix is supported for all the alert types included (that is, autofix:supported).
• Custom filters: Creating a campaign using custom filters lets you define your own criteria for selecting alerts for the campaign, and lets you tailor your campaign to your organization's specific needs.

In addition, you can use the REST API to create and interact with campaigns more efficiently and at scale. For more information, see REST API endpoints for security campaigns.

Create a campaign

1. On GitHub, navigate to the main page of the organization.

2. Under your organization name, click Security.

   

3. In the left sidebar, click Campaigns.

4. Click Create campaign , then select one of the following options:

   • Click From template, then select a pre-defined campaign template from the list.
   • Click From code scanning filters, then add filters to define a subset of alerts for your campaign. See Examples of useful filters.

5. Review the set of alerts to be included in the campaign, and adjust the filters as necessary. Make sure you have chosen 1000 alerts or fewer.

6. When you are satisfied with the scope of the campaign, click Save as, then choose whether you want to create a draft campaign, or move straight ahead to finalizing the details of the campaign before publishing it:

   • If you plan to review the scope and details of the campaign prior to launch, or seek feedback on the implementation of the campaign, click Draft campaign.
   • If you intend to publish the campaign, and don't need a review phase, click Publish campaign.

7. Optionally, if you have chosen to create a draft campaign, edit, save, and review the details of the campaign:

   • Edit the "Campaign name" and "Short description" to match your campaign needs and to link to any resources that support the campaign.
   • Define a "Campaign due date" and select one or more "Campaign managers" as the primary contacts for the campaign. Campaign managers must be users or teams that are owners or security managers in the organization.
   • Optionally, provide a "Contact link", for example a link to a GitHub Discussions or another communication channel, for contacting the campaign managers.
   • Click Save draft.
   • When you are ready to publish the campaign, in the top right corner, click Review and publish.

8. On the "Publish campaign" page, review or edit the campaign details:

   • Campaign name
   • Short description
   • Due date
   • Campaign managers
   • Contact link

9. Optionally, to create campaign issues in each repository included in the campaign, on the "Publish campaign" page, under "Automations", select the checkbox next to "Create issues for NUMBER repositories in this campaign".

10. Click Publish campaign.

The security campaign is created and the campaign overview page is displayed.

Examples of useful filters

All the template filters include the following useful filters:

• is:open includes only alerts that are open in the default branch.
• autofilter:true includes only alerts that appear to be in application code.
• autofix:supported includes only alerts that are for rules that are supported for GitHub Copilot Autofix.

Once you include these core filters, you will usually want to add a filter to limit results to a specific rule name, severity, or tag. For example:

• is:open autofilter:true autofix:supported rule:java/log-injection to show only alerts for log injection in Java code.
• is:open autofilter:true autofix:supported tag:external/cwe/cwe-117 to show only alerts for "CWE 117: Improper Output Neutralization for Logs". This includes log injection in Java and other languages.
• is:open autofilter:true autofix:supported severity:critical to show only alerts with a security severity of critical.

For more information about the rules run by CodeQL and support for autofix, see Query lists for the default query suites.

For more information about filtering alerts, see Best practices for fixing security alerts at scale and Filtering alerts in security overview.

Launching a security campaign

When you create a campaign, all the alerts are automatically submitted to GitHub Copilot Autofix to be processed as capacity allows. This ensures that suggestions for alerts found in pull requests aren't delayed by a new campaign. In most cases, you should find that all suggestions that can be created are ready within an hour. At busy times of day, or for particularly complex alerts, it will take longer.

How developers know a security campaign has started

When a campaign is started, anyone with write access to a repository included in the campaign, and has subscribed to watch either "All activity" or "security alerts" in that repository, is notified.

In addition to the automatic notifications sent out, the new campaign is shown in the sidebar of the "Security" tab for each repository included. For more information about the developer experience, see Fixing alerts in a security campaign.

How to increase engagement with the security campaign

The best way to increase engagement with a campaign is to publicize it to the teams you want to collaborate with to remediate alerts. For example, you might work with engineering managers to choose a quieter development period to run a series of security campaigns, each focused on a different type of alert, with associated training sessions. For more ideas, see Best practices for fixing security alerts at scale.

Editing security campaign details

You can edit the name, description, due date, and manager for a campaign.

1. On GitHub, navigate to the main page of the organization.

2. Under your organization name, click Security.

   

3. In the left sidebar, click Campaigns.

4. From the list of campaigns, click the name of the campaign to display the campaign tracking view.

5. In the campaign title row, click and select Edit campaign.

6. In the "Edit campaign" dialog make your changes and then click Save changes.

The changes are made immediately.

Closing, reopening and deleting security campaigns

There is a limit of 10 active campaigns. When a campaign is complete, or if you want to pause it, you should close it. You can still view all closed campaigns in the "Closed" campaign list, and you can reopen a closed campaign.

If you don't need to retain the campaign or its data, you can delete it.

Close a campaign

1. On GitHub, navigate to the main page of the organization.

2. Under your organization name, click Security.

   

3. In the left sidebar, click Campaigns.

4. To the right of the campaign you want to close, click , then select Close campaign.

Reopen a closed campaign

1. On GitHub, navigate to the main page of the organization.

2. Under your organization name, click Security.

   

3. In the left sidebar, click Campaigns.

4. Above the list of campaigns, click Closed to view the list of closed campaigns.

5. To the right of the campaign you want to reopen, click , then select Reopen campaign.

Delete a campaign

1. On GitHub, navigate to the main page of the organization.

2. Under your organization name, click Security.

   

3. In the left sidebar, click Campaigns.

4. To the right of the campaign you want to delete, click , then select Delete campaign.

Next steps

• Tracking security campaigns