Skip to main content
View as Markdown

Threat Detection

info

The English user guide is currently in beta preview. Most of the documents have been automatically translated from the Japanese version. Should you find any inaccuracies, please reach out to Flatt Security.

Threat detection is a feature that proactively investigates trace logs when a supply-chain incident occurs and notifies you of the affected jobs.

When an incident occurs, investigating its impact effectively requires a certain amount of expertise, and the response needs to be fast. With this feature, an investigation that leverages our know-how and systems is carried out promptly. You are notified of what the incident is and which CI/CD job runs are likely affected.

Receiving notifications requires setup. See Threat Notifications below.

Caveats​

The following caveats should be noted:

  • Detection is not definitive: Threat detection results are reports of "suspicious behavior" — final judgment must be made by the user
  • Not all attacks can be detected: Sophisticated attacks that are indistinguishable from normal build processes may not be detected

Threat Notifications​

Configuring Notifications​

Configure notifications with the following steps:

  1. In the Shisho Cloud console, navigate to Runner > Settings and open Threat Notifications.

    Threat notification settings

  2. Turn on the Email notifications toggle and choose the destination address from Target address. If the address you want is not shown in the Target address dropdown, add it from Settings > Email Allowlist in the Shisho Cloud console. For details, see Configuring Email Notifications.

  3. Click the Save button at the bottom of the screen.

Once the settings are saved, notifications will be sent when a threat is detected in your executed CI/CD jobs.

Sending a Test Notification​

You can send a test notification to the configured email address to confirm that the setup is correct. The test is sent to the destination currently selected on the screen, so you can check even before saving.

  1. In the Threat Notifications settings, click Send test notification.

    Send a test threat notification

  2. An email is sent with the subject "[Shisho Cloud] Takumi Runner threat detection notification test".

Last updated on