Open

For general information & instructions on the use of Remote Providers within ThreadFix, please refer to this page's parent page: Remote Providers. For information on REST API functionality for Remote Providers, please refer to the following: Remote Providers API.

GitHub Remote Provider Setup

To setup this remote provider, a GitHub username and OAuth Token (non-expired Personal Access Token with public_repo scope) are required.

Generate Token

The process below covers generating a token if one is not already available.

1. In GitHub, navigate to the user’s Settings > Developer Settings > Personal Access Token. Click the Generate new token button.
   
   

   Open

   

2. Provide a name, expiration date, and select any appropriate scopes. At a minimum, select a scope of public_repo.
   
   

    

3. Click the Generate Token button. Copy the Personal Access Token for use when setup GitHub as a new Provider in ThreadFix.

Remote Provider Setup

From the Integrations menu, on the Remote Providers page, select the Create New Remote Provider button. In the Create New Provider modal enter a GitHub username and an OAuth Token and click the Create Provider button to create the provider in ThreadFix.

Once the provider has been created, applications and teams can be mapped, and scans imported. Note the example below.

ThreadFix imports vulnerabilityAlerts from GitHub in batches of 100, each of the vulnerabilityAlerts contains a securityVulnerability and a securityAdvisory object within. This information is used to create findings and dependency data.

Findings

• Description: ThreadFix builds the description using the firstPatchedVersion, vulnerableVersionRange, and securityAdvisory description. If there is no firstPatchedVersion ThreadFix will insert the text “No fix” in place of the version. A description will have the following form:

  • “Vulnerable versions: <vulnerableVersionRange>

  • Patched versions: <firstPatchedVersion>

  • Description: <securityAdvisory description>”

• Severity Code: This is the severity pulled from the securityVulnerability

• CVE: If the securityAdvisory contains a CVE it will be stored here

• Native ID: This is a hash of the ghsaId (GitHub Security Advisory ID) and the CVE. Both of these values are found within the securityAdvisory

• Vulnerability Code: This will be the summary attribute of the securityAdvisory

• Source File Name: This is the vulnerableManifestPath taken from the vulnerabilityAlert

• Raw Finding: String version of the whole vulnerabilityAlert

Dependency

• Reference: This will be the same as the CVE above

• Description: This will be the same as the description above

• Component Name: This is the name of the vulnerablePackage found inside of the securityVulnerability

• Component File Path: This will be the same as the Source File Name above

Queries

Search Queries

ThreadFix uses GitHub’s search queries to pull its repositories, see below via https://docs.github.com/en/graphql/reference/queries#searchresultitemconnection.

Repository Queries

ThreadFix uses GitHub’s repository query to pull Dependabot alerts, see below via https://docs.github.com/en/graphql/reference/queries#repository.

Table of Contents