[0:00]Hello, everyone. My name is Matt, I am a senior technical product manager here at Gitlab. Today, I'm going to show you a quick demo of some of the new features that we've released recently that will allow you to do better threat modeling and vulnerability management within Gitlab. I'm going to show you how you can enable a security policy to automatically create an issue for a new vulnerability, how you can use a merge request to resolve that vulnerability, and then how you can monitor the status of your vulnerabilities using the new Gitlab vulnerability report. First, I'm going to navigate to a project that I have set up with some new vulnerabilities. Once I'm in the project, I'm going to navigate to secure security policies. From here, I'm going to create a new scan result policy. Once I'm here, I'm going to click new policy, and I'm going to give it a name. I'm going to name it issue creation, and I'm going to enable an action to create an issue for all new vulnerabilities. Now, I'm going to make sure that this policy applies to all of the projects in the group where this policy is stored. Once I've done that, I'm going to click configure with a merge request. Now that I've clicked that button, Gitlab has created a new merge request with the new policy. I can verify this by going to the security policy project and looking at the YAML file. This confirms that the new policy has been created. So, I'm going to go back to the merge request that Gitlab has created for me and I'm going to merge it. Now that the policy has been created, I'm going to run a new pipeline against the default branch in my project. This will trigger the new policy that I've just created and Gitlab will automatically create new issues for new vulnerabilities. So now that the pipeline is finished running, I'm going to go to the new vulnerability report and look at the new issues that Gitlab has created for me. Here, I can see all the new issues that Gitlab has created, and these are all linked directly to a new vulnerability. Now, I'm going to click on one of these vulnerabilities, and I'm going to click resolve with merge request. Once I've done that, Gitlab will automatically create a new merge request that will resolve the vulnerability and the issue that I have just created. Now that the merge request has been created, I'm going to go ahead and merge it. Once the merge request has been merged, I'm going to go back to my pipeline page to make sure that the pipeline has run and that the vulnerability has been resolved. So now that the pipeline has finished running, I'm going to go back to the vulnerability report to see the status of all of my vulnerabilities. Here, I can see that the vulnerability that I've just resolved has been dismissed, and all of my other vulnerabilities are still detected. And there you have it, a quick demo of some of the new features that we've released recently that allow you to do better threat modeling and vulnerability management within Gitlab. Thank you.
Watch on YouTube
Share
MORE TRANSCRIPTS



