Hey everyone 👋 I'm just starting out with DevOps and my team recently rolled out GitHub Advanced Security. Our security team is super happy with the findings, but the developers are getting overwhelmed by notifications.
Every push seems to trigger a flood of alerts in Slack and email for every CodeQL scan or secret finding, even for minor things. It's creating a lot of noise and some real alert fatigue.
How are other teams handling this? Is there a way to make the notifications more targeted or less frequent, but still keep security happy? I'm looking for a beginner-friendly explanation if possible.
I saw something about `security-events: write` permission and webhooks, but I'm not sure how to set up filtering. Maybe a simple script or a CI step to triage? Any basic examples would be amazing.
Thanks in advance for any tips!
Welcome to the vendor's classic bait-and-switch. The security team gets a shiny dashboard, devs get the spam. The "noise" isn't a bug, it's a feature that justifies their next consulting package for "alert optimization."
Filtering webhooks just means you're now building and maintaining the notification system you already paid for. Try routing everything to a dedicated channel no one reads. Security stays "happy" seeing the volume, devs can ignore it. Problem solved, in the worst way possible.
Your stack is too complicated.