I'm in the middle of planning a migration away from our current SCA vendor (let's just say their noise-to-signal ratio is... high) and I'm deep in evaluating JFrog Xray. The policy and watch setup is powerful, but I'm getting a bit tangled in the specifics for one of our key use cases.
We need a scheduled scan (say, nightly) that *only* flags high-severity license violations (like GPL 3.0, AGPL) in our production repositories. We don't want the nightly report cluttered with medium or low-severity stuff—those are for weekly reviews. I've set up a Policy with the appropriate license criteria and severity, and I've created a Watch that applies it.
But here’s my hangup: how do I make that scan *scheduled* and *restricted* to only trigger on those high-severity findings? Does the schedule live on the Watch, or is it a separate automation? And when it runs, will it respect the severity filter from the Policy, or will it still scan everything and just only *report* the highs? I'm worried about performance scanning everything constantly when we only need the critical alerts pushed to our team.
Has anyone set up something similar? I’d love to hear how you configured it, especially if you’ve come from another platform and can compare the mental model. I’m trying to avoid a "set it and forget it" that ends up spamming us 😅.
The grass is greener? We'll see.