Question

You administer a GitHub Enterprise Server (GHES) instance and want to give your development teams visibility into which open-source dependencies used across your private repositories have known vulnerabilities, by leveraging the vulnerability data maintained in the GitHub Advisory Database on GitHub.com. Your instance currently has no connection to GitHub.com. Which action must you take first to enable this dependency and vulnerability insight capability?

Accepted Answer

Enable GitHub Connect to link the GHES instance to GitHub.com, then turn on Dependabot alerts, which sync vulnerability data from the GitHub Advisory Database

Answer

Configure audit log streaming to a SIEM so that dependency events are captured and correlated externally

Answer

Generate a support bundle and open a ticket with GitHub Support to request an advisory database export

Answer

Manually upload the GitHub Advisory Database as a CSV to each repository's Security tab