Threat Center

Available for Enterprise Tier only

The Threat Center in StepSecurity is your central view into all supply chain compromises detected by StepSecurity. It provides a real-time feed of active incidents alongside historical records, making it easier to track, investigate, and respond.

For background on the intelligence powering the Threat Center, see our blog post.

Accessing the Threat Center

Step 1: Open the StepSecurity Dashboard

• From the left-hand menu, click Threat Center. The page displays a list of active threats, marked with a red Active badge, along with historical incidents that include their start and close times.

You can also open the Threat Center directly by clicking the 🔔 New Threat notification in the dashboard header

Step 2: Expand Threat Details

• Click Show Details on any incident to see:

  • A description of the compromise
  • Affected packages or Actions
  • Recommended remediation steps you can take directly within StepSecurity

Identifying threats that affect you

Not every incident in the Threat Center touches your organization. StepSecurity evaluates each incident against your environment and flags the ones you are exposed to, so you can focus remediation on what actually applies to you. An incident is treated as affecting you when StepSecurity finds either of the following:

• A matched component: a compromised package from the incident is present in one of your repositories, either in an open pull request or on the default branch.
• A matched IOC: an indicator of compromise from the incident, such as a malicious network endpoint, was observed in your Harden-Runner runtime data.

Filter by exposure

At the top of the Threat Center, two tabs control which incidents are shown:

• All lists every incident StepSecurity has published, with a count of the total.
• Affecting You lists only the incidents that affect your organization, with a count of how many currently apply to you.

Incidents that affect you also carry a red You are affected badge next to the title, in both views.

Reviewing an affected incident

Open an affected incident to see exactly where and how you are exposed. A summary banner at the top reports the scope of your exposure, for example "Your tenant is affected across 1 organization," together with a count of matched components and matched IOCs.

Matched components

For each affected organization, the Matched components section lists every compromised package found in your repositories, tagged with its ecosystem (for example, npm). Under each package, StepSecurity shows where the compromised version was found:

• Pull request matches show the pull request number and title, who opened it, the date, the matched version, the head commit, and the affected files (for example, package-lock.json).
• Default branch matches indicate that the compromised version is present on the repository's default branch, such as main, and not only proposed in a pull request.

Matched IOCs

The Matched IOCs section lists indicators of compromise from the incident that were observed in your Harden-Runner runtime data. For a network endpoint IOC, StepSecurity shows the endpoint, when it was first and last seen, the total number of calls, and a per-run breakdown under Endpoint observations listing the repository, workflow, job, and run for each observed call. This lets you trace an IOC back to the exact workflow run that contacted it.

Notifications and Integrations

Threat Center incidents are delivered through your existing StepSecurity notification channels, so your team is informed immediately:

• Slack
• Email
• AWS S3
• Webhook

Whether you are notified about every incident or only about incidents that affect your organization is controlled by your threat intel notification granularity:

• All threat intel incidents: every incident, whether or not you are affected.
• Affected packages: only incidents where a compromised package matches your dependencies by name.
• Exact version only: only incidents where you use the exact compromised version.

Configure granularity and channels at the organization level in Notifications, or tenant-wide in Admin Console Notifications.

Because alerts are integrated with your existing systems, you can automate the response process. For example, you can configure your SIEM so that when a new Threat Center event is raised, an on-call engineer is automatically paged.

See an example detection event here

Querying Compromised Components via API

In addition to the dashboard view, you can retrieve the compromised Open Source Software (OSS) components for a specific incident programmatically through the StepSecurity API. This is useful for feeding incident data into your own tooling, automating triage, or correlating compromised packages against your dependency inventory.

The endpoint returns all compromised components tied to an incident, including the package ecosystem, affected version, severity, verification status, and a description of the threat.

GET /github/{owner}/threat-intel/incidents/{incidentId}/compromised-components

The request takes your GitHub organization (owner) and the unique incident identifier (incidentId) as path parameters, and requires a valid StepSecurity API token.

Example Response

{
  "compromised_components": [
    {
      "type": "npm",
      "component_name": "malicious-pkg",
      "version": "1.2.3",
      "incident_group_id": "ig-001",
      "description": "Package contains malicious code that exfiltrates credentials",
      "severity": "critical",
      "verified": true,
      "added_at": "2024-01-15T10:00:00Z",
      "threat_intel_id": "f47ac10b-58cc-4372-a567-0e02b2c3d479"
    }
  ]
}