From 993c430ae64de1ffcc8876164b4020295ff80308 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ren=C3=A9=20Schumacher?= Date: Fri, 15 Dec 2023 13:50:44 +0100 Subject: [PATCH 1/4] Add billing subscription prerequisite --- labs/azuredevops/advancedsecurity/readme.md | 1 + 1 file changed, 1 insertion(+) diff --git a/labs/azuredevops/advancedsecurity/readme.md b/labs/azuredevops/advancedsecurity/readme.md index 0f10a6a71..916b557de 100644 --- a/labs/azuredevops/advancedsecurity/readme.md +++ b/labs/azuredevops/advancedsecurity/readme.md @@ -41,6 +41,7 @@ In this lab, you will see how you can use Advanced Security to protect the Azure ### Before you begin - This lab requires you to complete task 1 from the prerequisite instructions. +- Since GitHub Advanced Security for Azure DevOps requires billing, you must have set up a billing subscription for your organization. ### Task 1: Enable Advanced Security from Portal From 2d2dc478767862164dcce1d2826d7f652b94f596 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ren=C3=A9=20Schumacher?= Date: Fri, 15 Dec 2023 14:29:02 +0100 Subject: [PATCH 2/4] Remove tip about squash merge from vulnerability scanning lab --- labs/azuredevops/advancedsecurity/readme.md | 3 --- 1 file changed, 3 deletions(-) diff --git a/labs/azuredevops/advancedsecurity/readme.md b/labs/azuredevops/advancedsecurity/readme.md index 916b557de..2b8373bb9 100644 --- a/labs/azuredevops/advancedsecurity/readme.md +++ b/labs/azuredevops/advancedsecurity/readme.md @@ -187,9 +187,6 @@ When a Dependency Alert is created in Azure DevOps Advanced Security, it will co The build will run automatically, initiating the dependency scanning task and publishing the results to Advanced Security and alert automatically closed. - >**ProTip!** Squash Merge is important. If we just commit, the exposed credential will still be in the history. To avoid this, fix code, use a Squash Merge, push it to repo, and you're done! - - 1. Once the pipeline has been completed, **eShopOnWeb**, go to the Azure DevOps Advanced Security dashboard and click on Dependencies. 1. You will see that the alert *Improper Input Validation in IpMatcher....*... no longer exists, as it is now closed. From 46f923ddebe8bee31fc7a4448159811508844417 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ren=C3=A9=20Schumacher?= Date: Fri, 15 Dec 2023 14:49:07 +0100 Subject: [PATCH 3/4] Fix ProTip format --- labs/azuredevops/advancedsecurity/readme.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/labs/azuredevops/advancedsecurity/readme.md b/labs/azuredevops/advancedsecurity/readme.md index 2b8373bb9..7dd37868c 100644 --- a/labs/azuredevops/advancedsecurity/readme.md +++ b/labs/azuredevops/advancedsecurity/readme.md @@ -369,7 +369,7 @@ Code scanning in GitHub Advanced Security for Azure DevOps lets you analyze the 4. Click on Detections to see the different builds that detected this alert. - > ProTip! + > **ProTip!** > When a vulnerable component is no longer detected in the latest build for pipelines with the dependency scanning task, the state of the associated alert is automatically changed to Closed. To see these resolved alerts, you can use the State filter in the main toolbar and select Closed. From 3bfae1f00788f24b3e6e41fe728c40771ca4571c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ren=C3=A9=20Schumacher?= Date: Fri, 15 Dec 2023 14:50:20 +0100 Subject: [PATCH 4/4] Remove pro tip from code scanning Wrong tip (is about component scanning) --- labs/azuredevops/advancedsecurity/readme.md | 4 ---- 1 file changed, 4 deletions(-) diff --git a/labs/azuredevops/advancedsecurity/readme.md b/labs/azuredevops/advancedsecurity/readme.md index 7dd37868c..7122b6d94 100644 --- a/labs/azuredevops/advancedsecurity/readme.md +++ b/labs/azuredevops/advancedsecurity/readme.md @@ -369,10 +369,6 @@ Code scanning in GitHub Advanced Security for Azure DevOps lets you analyze the 4. Click on Detections to see the different builds that detected this alert. - > **ProTip!** - > When a vulnerable component is no longer detected in the latest build for pipelines with the dependency scanning task, the state of the associated alert is automatically changed to Closed. To see these resolved alerts, you can use the State filter in the main toolbar and select Closed. - - #### Fixing the Code to resolve the alert 1. This is simple to fix using the method using parameters with dynamic SQL described in the Remediation steps.