Skip to main content
{ Vulnerability Management }

Azure DevOps Advanced Security Alert Triage

Reviews open Advanced Security dependency alerts for reachability in deployed code and dismisses the unreachable ones.

What this agent does

This agent triages the open dependency alerts that Advanced Security raises on an Azure DevOps repository. It judges each alert against the current code on the default branch. It dismisses an alert as accepted risk only when the evidence shows the vulnerable code is unreachable or used outside production. It leaves every other alert open.

The challenge

Advanced Security dependency scanning raises an alert for every vulnerable version in a dependency manifest the pipeline scans. Many of those packages never run in production, or never reach the vulnerable code. Engineers cannot review every alert by hand, so the open list grows and the real risk is hard to see.

The solution

The agent reviews a bounded number of the most severe alerts on each run. It records the evidence for every dismissal in the dismissal comment, so a reviewer can check each verdict. It leaves reachable and uncertain alerts open, and it never fixes, upgrades, or merges anything.

Workflow

  1. 01

    Select alerts

    Take the top open dependency alerts by severity, so each run covers a bounded set.

  2. 02

    Judge reachability

    Check whether the vulnerable package is used in production and whether anything reaches the vulnerable code on the default branch.

  3. 03

    Dismiss unreachable alerts

    Dismiss an alert as accepted risk only on evidence of unreachability or non-production use, with that evidence in the comment.

  4. 04

    Leave the rest open

    Keep reachable and uncertain alerts open. Leave alerts on an already upgraded dependency for the next pipeline scan to close.

  5. 05

    Report

    List each alert left open as reachable, with its evidence, and track the open and dismissed counts.

Agent template 

# Azure DevOps Advanced Security Alert Triage

## Measurable outcomes

Dependency alerts left open on a repository represent real risk. Every provably unreachable alert is dismissed with its evidence in the dismissal comment. Track both values on each run.

## Procedure

For a given repository, take the top N open dependency alerts on the default branch by highest severity to keep each run bounded. Judge each alert against the current code on the default branch: is the vulnerable package used in production, and does anything reach the vulnerable code? Advanced Security offers accepted risk and false positive as dismissal types, and a dismissal applies across every branch. Use accepted risk. Dismiss an alert only when the evidence shows it is unreachable or in a non-production use (local tooling, pipeline only, test only, etc), and record that evidence in the dismissal comment. Leave reachable or uncertain alerts open. Leave alerts whose dependency is already upgraded for the next pipeline scan to close. Advanced Security updates dependency alerts only when the scanning task runs. The run report lists each alert left open as reachable, with its evidence. Start in a report-only mode so I can review its verdicts before it dismisses any alerts.

## Requirements

It needs Azure DevOps read access to the repository's code and read and write access to its Advanced Security alerts, through a personal access token with the Code (Read) and Advanced Security (Read and write) scopes held by an identity with the Advanced Security permission to manage and dismiss alerts, and nothing more. It never fixes, bumps, or merges anything. Fixes belong to the repository's owners.