> For the complete documentation index, see [llms.txt](https://docs.stepsecurity.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.stepsecurity.io/workspace/threat-center.md).
# Threat Center
{% hint style="warning" %}
Available for **Enterprise** Tier only
{% endhint %}
The Threat Center in StepSecurity is your central view into all supply chain compromises detected by StepSecurity. It provides a real-time feed of active incidents alongside historical records, making it easier to track, investigate, and respond.
For background on the intelligence powering the Threat Center, [see our blog post](https://www.stepsecurity.io/blog/introducing-stepsecurity-threat-intelligence-real-time-supply-chain-attack-alerts-for-your-siem).
### Accessing the Threat Center
#### Step 1: Open the StepSecurity Dashboard
* From the left-hand menu, click Threat Center. The page displays a list of active threats, marked with a red Active badge, along with historical incidents that include their start and close times.
{% hint style="info" %}
You can also open the Threat Center directly by clicking the 🔔 New Threat notification in the dashboard header
{% endhint %}
#### Step 2: Expand Threat Details
* Click Show Details on any incident to see:
* A description of the compromise
* Affected packages or Actions
* Recommended remediation steps you can take directly within StepSecurity
### Identifying threats that affect you
Not every incident in the Threat Center touches your organization. StepSecurity evaluates each incident against your environment and flags the ones you are exposed to, so you can focus remediation on what actually applies to you. An incident is treated as affecting you when StepSecurity finds either of the following:
* A **matched component**: a compromised package from the incident is present in one of your repositories, either in an open pull request or on the default branch.
* A **matched IOC**: an indicator of compromise from the incident, such as a malicious network endpoint, was observed in your Harden-Runner runtime data.
#### **Filter by exposure**
At the top of the Threat Center, two tabs control which incidents are shown:
* **All** lists every incident StepSecurity has published, with a count of the total.
* **Affecting You** lists only the incidents that affect your organization, with a count of how many currently apply to you.
Incidents that affect you also carry a red **You are affected** badge next to the title, in both views.
#### **Reviewing an affected incident**
Open an affected incident to see exactly where and how you are exposed. A summary banner at the top reports the scope of your exposure, for example "Your tenant is affected across 1 organization," together with a count of matched components and matched IOCs.
#### **Matched components**
For each affected organization, the **Matched components** section lists every compromised package found in your repositories, tagged with its ecosystem (for example, npm). Under each package, StepSecurity shows where the compromised version was found:
* **Pull request** matches show the pull request number and title, who opened it, the date, the matched version, the head commit, and the affected files (for example, `package-lock.json`).
* **Default branch** matches indicate that the compromised version is present on the repository's default branch, such as `main`, and not only proposed in a pull request.
#### **Matched IOCs**
The **Matched IOCs** section lists indicators of compromise from the incident that were observed in your Harden-Runner runtime data. For a network endpoint IOC, StepSecurity shows the endpoint, when it was first and last seen, the total number of calls, and a per-run breakdown under **Endpoint observations** listing the repository, workflow, job, and run for each observed call. This lets you trace an IOC back to the exact workflow run that contacted it.
### Notifications and Integrations
Threat Center incidents are delivered through your existing StepSecurity notification channels, so your team is informed immediately:
* Slack
* Email
* AWS S3
* Webhook
Whether you are notified about every incident or only about incidents that affect your organization is controlled by your **threat intel notification granularity**:
* **All threat intel incidents:** every incident, whether or not you are affected.
* **Affected packages:** only incidents where a compromised package matches your dependencies by name.
* **Exact version only:** only incidents where you use the exact compromised version.
Configure granularity and channels at the organization level in Notifications, or tenant-wide in Admin Console Notifications.
Because alerts are integrated with your existing systems, you can automate the response process. For example, you can configure your SIEM so that when a new Threat Center event is raised, an on-call engineer is automatically paged.
See an example detection event [here](/administration/admin-console/integrations/sample-detection-events.md#threat-intelligence)
### Querying Compromised Components via API
In addition to the dashboard view, you can retrieve the compromised Open Source Software (OSS) components for a specific incident programmatically through the StepSecurity API. This is useful for feeding incident data into your own tooling, automating triage, or correlating compromised packages against your dependency inventory.
The endpoint returns all compromised components tied to an incident, including the package ecosystem, affected version, severity, verification status, and a description of the threat.
```
GET /github/{owner}/threat-intel/incidents/{incidentId}/compromised-components
```
The request takes your GitHub organization (`owner`) and the unique incident identifier (`incidentId`) as path parameters, and requires a valid StepSecurity API token.
**Example Response**
```json
{
"compromised_components": [
{
"type": "npm",
"component_name": "malicious-pkg",
"version": "1.2.3",
"incident_group_id": "ig-001",
"description": "Package contains malicious code that exfiltrates credentials",
"severity": "critical",
"verified": true,
"added_at": "2024-01-15T10:00:00Z",
"threat_intel_id": "f47ac10b-58cc-4372-a567-0e02b2c3d479"
}
]
}
```
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.stepsecurity.io/workspace/threat-center.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.