Question

Your security team wants to feed Dependabot alerts into an internal ticketing system so that a ticket is automatically created whenever a new dependency vulnerability is detected. The integration engineer needs to know which mechanism GitHub provides to push these events to an external endpoint in real time, and what payload identifier distinguishes a newly surfaced alert from other alert lifecycle events. Which approach correctly satisfies this requirement?

Accepted Answer

Configure a repository or organization webhook subscribed to the 'dependabot_alert' event and filter on the 'created' action in the payload.

Answer

Enable email notifications for Dependabot alerts and configure a mail parser to generate tickets from the messages.

Answer

Configure a webhook subscribed to the 'security_advisory' event and filter on the 'published' action in the payload.

Answer

Poll the SBOM export endpoint on a schedule and diff the dependency list to detect newly added vulnerable packages.