Skip to main content
Enterprise Cloud
English
Sign up
 
Code security
Enterprise Cloud
English
Sign up

 

Filtering alerts in the security overview

In this article

Use filters to view specific categories of alerts

Organization owners and security managers can access the security overview for organizations and view their organization's repositories via the enterprise-level security overview. Enterprise owners can use the enterprise-level security overview to view all repositories in their enterprise's organizations. Members of a team can see the security overview for repositories that the team has admin privileges for.

The security overview for your organization is available if you have a license for GitHub Advanced Security. For more information, see "About GitHub Advanced Security."

About filtering the security overview

You can use filters in the security overview to narrow your focus based on a range of factors, like alert risk level, alert type and feature enablement. Different filters are available depending on the specific view and whether your analysis is at the organization, team or repository level.

Filter by repository

Available in all organization-level and team-level views.

QualifierDescription
repo:REPOSITORY-NAMEDisplays alerts for the specified repository.

Filter by whether security features are enabled

Available in the organization-level and team-level overview.

QualifierDescription
code-scanning:enabledDisplay repositories that have code scanning enabled.
code-scanning:not-enabledDisplay repositories that do not have code scanning enabled.
secret-scanning:enabledDisplay repositories that have secret scanning enabled.
secret-scanning:not-enabledDisplay repositories that have secret scanning enabled.
dependabot:enabledDisplay repositories that have Dependabot alerts enabled.
dependabot:not-enabledDisplay repositories that do not have Dependabot alerts enabled.
not-enabled:anyDisplay repositories with at least one security feature that is not enabled.

Filter by repository type

Available in the organization-level and team-level overview.

QualifierDescription
is:publicDisplay public repositories.
is:internalDisplay internal repositories.
is:privateDisplay private repositories.
archived:trueDisplay archived repositories.
archived:trueDisplay archived repositories.

Filter by level of risk for repositories

The level of risk for a repository is determined by the number and severity of alerts from security features. If one or more security features are not enabled for a repository, the repository will have an unknown level of risk. If a repository has no risks that are detected by security features, the repository will have a clear level of risk. Available in the organization-level overview.

QualifierDescription
risk:highDisplay repositories that are at high risk.
risk:mediumDisplay repositories that are at medium risk.
risk:lowDisplay repositories that are at low risk.
risk:unknownDisplay repositories that are at an unknown level of risk.
risk:clearDisplay repositories that have no detected level of risk.

Filter by number of alerts

Available in the organization-level overview.

QualifierDescription
code-scanning:nDisplay repositories that have n code scanning alerts. This qualifier can use =, > and < comparison operators.
secret-scanning:nDisplay repositories that have n secret scanning alerts. This qualifier can use =, > and < comparison operators.
dependabot:nDisplay repositories that have n Dependabot alerts. This qualifier can use =, > and < comparison operators.

Filter by team

Available in the organization-level overview.

QualifierDescription
team:TEAM-NAMEDisplays repositories that TEAM-NAME has admin privileges for.

Filter by topic

Available in the organization-level overview.

QualifierDescription
topic:TOPIC-NAMEDisplays repositories that are classified with TOPIC-NAME.

Filter by severity

Available in the code scanning alert views. All code scanning alerts have one of the categories shown below. You can click any result to see full details of the relevant rule, and the line of code that triggered the alert.

QualifierDescription
severity:criticalDisplays code scanning alerts categorized as critical.
severity:highDisplays code scanning alerts categorized as high.
severity:mediumDisplays code scanning alerts categorized as medium.
severity:lowDisplays code scanning alerts categorized as low.
severity:errorDisplays code scanning alerts categorized as errors.
severity:warningDisplays code scanning alerts categorized as warnings.
severity:noteDisplays code scanning alerts categorized as notes.

Filter by Dependabot alert type

Available in the Dependabot alert views. You can filter the view to show Dependabot alerts that are ready to fix or where additional information about exposure is available. You can click any result to see full details of the alert.

QualifierDescription
has:patchDisplays Dependabot alerts for vulnerabilities where a secure version is already available.
has:vulnerable-callsDisplays Dependabot alerts where at least one call from the repository to a vulnerable function is detected. For more information, see "Viewing and updating Dependabot alerts."

Filter by secret types

Available in the secret scanning alert views.

QualifierDescription
secret-type:SERVICE_PROVIDERDisplays alerts for the specified secret and provider. For more information, see "Secret scanning patterns."
secret-type:CUSTOM-PATTERNDisplays alerts for secrets matching the specified custom pattern. For more information, see "Defining custom patterns for secret scanning."

Filter by provider

Available in the secret scanning alert views.

QualifierDescription
provider:PROVIDER_NAMEDisplays alerts for all secrets issues by the specified provider. For more information, see "Secret scanning patterns."