Data source onboarding
Onboarding data sources is an operator task: the platform or SecOps team connects the repositories and collaboration tools that Vault Radar scans, then tunes detection so that findings are accurate and actionable.
Connect data sources
Follow the documentation page for connecting a data source for the following supported platforms:
As mentioned within the Vault Radar documentation, there is a limit of 20,000 repositories per data source. If you have more than 5,000 repositories, Vault Radar selects the 5,000 repositories with the most recent activity. To onboard more repositories, you need to create more connections and select the remaining repositories.
To scan private, non-internet-accessible sources, onboard them through a Vault Radar agent — see Agent deployment.
Tune secrets detection
After connecting a data source, tune the secrets detection with regex patterns and rules:
Reduce false positive fatigue
To combat false positive fatigue, security teams should focus on improving detection engineering, tuning Vault Radar, and enhancing alert context. This involves reducing the volume of irrelevant alerts, providing more information about alerts, and automating investigations to prioritize genuine threats.
Key strategies to reduce false positive fatigue are:
- Prioritize by severity level: Focus on alerts with higher severity and potential impact, rather than overwhelming analysts with a large volume of low-priority alerts.
- Test custom regex patterns: Thoroughly test any new or modified detection rules to ensure they function as expected and don't introduce unintended consequences.
- Monitor false positives: Regularly monitor and analyze false positives to identify patterns and adjust rules accordingly, improving the overall accuracy of the scanning process.
- Exclude directories with mock data: This helps prevent Vault Radar from flagging mock data that is intentionally not sensitive.
- Manage ignore rules: The same applies for developing Global/repository specific ignore rules to reduce the flagging of findings that are not actually sensitive.