diff --git a/content/hcp-docs/content/docs/vault-radar/manage/event-workflow.mdx b/content/hcp-docs/content/docs/vault-radar/manage/event-workflow.mdx new file mode 100644 index 0000000000..e457b39622 --- /dev/null +++ b/content/hcp-docs/content/docs/vault-radar/manage/event-workflow.mdx @@ -0,0 +1,29 @@ +--- +page_title: HCP Vault Radar event workflow +description: >- + HCP Vault Radar event workflow and its states +--- + + +# Vault Radar Events + +HCP Vault Radar creates an event each time it finds content that matches the criteria of a secret type or a custom expression. Events provide context for remediation and allow security teams to keep track of its progress. + +You can track the remediation of findings using event states which can be set automatically or by a user. + + +## Event status + +- **New** - the default state when HCP Vault Radar creates a new event +- **Notified** - set automatically when Radar sends an alert or notification. This state cannot be set manually +- **To Remediate** - set by a developer to confirm that the event needs to be remediated +- **Secret Stored** - set automatically when a developer triggers a remediation action, though developers can set it manually as well. To learn more about [remediation actions](../remediate-secrets/copy-secrets) +- **Secret Revoked** - set by a developer to confirm they revoked the secret value +- **Resolved** - set by a developer to confirm remediation is complete +- **False Positive** - set by a developer to confirm the event is a false positive +- **Ignore Rule** - set automatically when a developer uses the inline ignore rule or sets an ignore rule within a repo via YAML file. To learn more about [inline ignore rules](./write-inline-ignore-rules) +- **Not Important** - set automatically when an event meets a global ignore rule's criteria. To learn more about [global ignore rules](./write-global-ignore-rules) +- **Deleted** - set automatically when an event is no longer relevant due to an improvement to Radar's detection algorhythm or due to a custom expression being deleted + +![Diagram showing the event workflow for Vault Radar](/img/docs/vault-radar/radar-event-state-workflow.png) + diff --git a/content/hcp-docs/data/docs-nav-data.json b/content/hcp-docs/data/docs-nav-data.json index e4ec42e9da..931af9649a 100644 --- a/content/hcp-docs/data/docs-nav-data.json +++ b/content/hcp-docs/data/docs-nav-data.json @@ -944,6 +944,10 @@ { "title": "Risk Severity", "path": "vault-radar/manage/severity" + }, + { + "title": "Event workflow and states", + "path": "vault-radar/manage/event-workflow" }, { "title": "Select event rules", diff --git a/content/hcp-docs/img/docs/vault-radar/radar-event-state-workflow.png b/content/hcp-docs/img/docs/vault-radar/radar-event-state-workflow.png new file mode 100644 index 0000000000..3ca114f53d Binary files /dev/null and b/content/hcp-docs/img/docs/vault-radar/radar-event-state-workflow.png differ