Skip to main content
View as Markdown

Periodic Assessment

info

The English user guide is currently in beta preview. Most of the documents have been automatically translated from the Japanese version. Should you find any inaccuracies, please reach out to Flatt Security.

Overview​

Periodic assessment automatically assesses the files changed on a GitHub repository's branch on a weekly or monthly schedule. At each scheduled time, Takumi runs a whitebox or graybox assessment on the files changed between the previous scheduled time and this one.

It can be used from the Shisho Cloud byGMO web interface and does not require Slack integration. It is a separate feature from Periodic Assessment (Slack), which is configured through Slack.

Each run assesses only the files changed during its period, so it consumes fewer credits than assessing the whole application every time. It suits repositories where features are added or modified frequently and you want to keep checking for vulnerabilities the changes introduce.

Prerequisites​

You can specify integrated GitHub repositories as the target of a periodic assessment. To integrate GitHub, see "Integrate GitHub".

Creating a Periodic Assessment​

Click "Assessment" in the sidebar, then select the "Periodic assessments" tab at the top of the screen to view the periodic assessment list. Click the "New periodic assessment" button to open the configuration screen.

Settings​

The main settings are as follows:

  • Name: Enter a name to identify this periodic assessment
  • Report Language: Select the report language (Japanese or English)
  • Schedule: Choose weekly or monthly, then the day of the week or month and the time to run. Times are in UTC. If you choose the 29th or later, months without that day run on their last day
  • Assessment Method: Select "Whitebox Assessment" or "Graybox Assessment"
  • Credit Threshold: Set the maximum credits one run consumes (minimum 50)
  • Source Code and File Scope: Specify the GitHub repositories and branches to assess, along with the scan scope and exclusions. These settings work the same as in Whitebox Assessment. For a graybox assessment, also specify the application settings as in Graybox Assessment
  • Notifications: Specify the Slack channels and email addresses to notify when an assessment created by this periodic assessment completes (optional)

Note that a repository can belong to only one periodic assessment.

How It Runs​

At each scheduled time, Takumi checks the following two conditions. If either is not met, that run is cancelled.

  • The organization's credit balance is at least the credit threshold
  • The target branch received a new push between the previous scheduled time and this one

When both conditions are met, Takumi creates an assessment of the files changed during the period and starts it automatically. The assessment appears in the assessment list.

Run Now​

To run without waiting for the scheduled time, select "Run now" from the menu on the row of the periodic assessment list. In this case, the assessment covers the files changed during the week (or month, for a monthly schedule) up to the time you run it.

Run History​

Select a periodic assessment from the list to open its detail page, where "Run history" shows each run's assessed period and result. The result is one of the following:

  • Started: An assessment has been created and started
  • Cancelled (no changes): Not run because the target branches received no push during the period
  • Cancelled (insufficient credits): Not run because the credit balance was below the credit threshold
  • Failed: The assessment could not be started due to another internal error

Reviewing Results​

You can open the report of an assessment created by a periodic assessment from the assessment list, just like a regular whitebox or graybox assessment. If notifications are set, a completion notification arrives by Slack or email when the assessment completes.

Editing and Deleting​

You can edit the settings on the periodic assessment's detail page. A changed schedule applies from the next scheduled time.

To delete a periodic assessment, select "Delete" from the menu on its row in the list. After deletion, no further runs take place, but the assessments it already created remain.

Regarding Credit Consumption​

Each run consumes credits within the credit threshold. A cancelled run consumes no credits.

If the organization's credit balance is below the credit threshold at the scheduled time, that run does not take place. Keep an eye on your credit balance while you use periodic assessments.

Last updated on