Skip to main content

Detect Source Code Overwrite

CI/CD jobs typically should not overwrite source code, specially for release builds.

  • This is a potential indicator of compromise
  • Malicious source code overwrites have caused major supply chain security breaches in the past, e.g. the SolarWinds breach
  • You can learn more about the significance of this activity by visiting Attack Simulations

Source Code Overwrite Insights

On the insights page, you can discover file overwrite events by looking for the file overwrite icon under Operations with Details highlighted in Red.

  • All source code files are monitored, which means even changes to Infrastructure as Code files (Kubernetes manifest, Terraform) are detected
  • The process that overwrote the file is shown in the insights page
  • You can enable notifications to get one-time alert when source code is overwritten

Source Code Overwrite