Explore Jit Features

Now that you've integrated with your SCM, you can return to your security plan and activate your plan's security controls.

Some security requirements cannot be activated until additional configuration steps are completed. For more information, refer to the specific requirement in Security Requirements.

Features exploration

The checklist below walks you through a basic exploration of Jit's features and capabilities. You can skip any items that are not relevant for your organization.

These steps are mostly relevant for Jit MVS for AppSec Plan and combine features relevant to code, cloud, and Web app security scanning.

Step 1 - SAST and developer experience

📘

The developer experience is contained entirely within the SCM. Security champions interact with Jit using the Jit platform UI.

• Activate the SAST security control in MVS Plan page
• From the SCM, open a PR with any of the following code snippets:
  • Python code snippet
  • Javascript code snippet
  • Go code snippet
• From the SCM, verify that Jit checks are running and failing due to detected vulnerabilities.
• View Jit’s comments in your PR. Note that you do not have to fix them immediately.

👍

You detected a vulnerability pre-production!

• From the Jit platform, navigate to the Pipelines page. View the pipeline that was created for the PR you opened.
• Click on the pipeline.
• To return to the PR in the SCM, click the PR link in the pipeline.
• Fix the vulnerabilities using Jit auto-remediation. (Fix suggestion).
• See that the checks have passed.

👍

You resolved a vulnerability pre-production!

• View the updated data in the Jit platform Overview page.

Step 2 - Slack and ticket management system integrations

• Integrate with Slack.
• Integrate with your ticket management system.
  • Integrating with Jira
  • Integrating with Linear
  • Integrating with Shortcut

Step 3 - IaC

• Activate Scan your infrastructure-as-code (IaC) for misconfigurations security control via the MVS Plan page.
• In the SCM, open a pull request with any of the following code snippets:
  • Terraform - EC2 instance has Public IP
  • Terraform - S3 Bucket without restriction of Public Bucket
  • Terraform - ALB listening on HTTP
• In the SCM, verify that Jit checks are running and failing due to detected vulnerabilities.
• View Jit’s comments in your PR. Note that you do not have to fix them immediately.
• In the Jit platform, go to Pull Requests page under the Insights section of the menu bar.
• Select Open with Findings. Select Show details for the PR you created. This will take you to the PR in the SCM.
• In the SCM, merge the PR with vulnerabilities.
• View Jit's Slack notifications in your configured channels.
• In the Jit platform, go to the Performance page under the Insights section of the menu bar.

Step 4 - Backlog findings

• From the the Jit platform, navigate to the Backlog page.
• Select any vulnerability.
• Select Create Ticket to create a ticket for the vulnerability.
• Add filters.
• Create a saved view.

Step 5 - Actions

• From the Jit platform, navigate to the Actions page.
• Create a fix PR for the vulnerability you've merged.
• Select View Fix PR to view the fix PR in the SCM.
• From the SCM, verify that Jit checks have passed successfully and select merge the PR.

Step 6 - Ignores

• From the SCM, interact with the Jit bot in a PR and ignore a finding.
• From the Backlog page, change the status of a finding to Ignored.
• Ignore a finding via the Actions page.

Step 7 - Advanced

• Activate all checks that do not require additional configuration.
  • All Application Security checks.
  • The following Cloud Security checks.
    • Scan your Dockerfiles for vulnerabilities
    • Scan Kubernetes configuration files
  • CI/CD security checks - Verify that MFA for your organization is enabled check.
• Configure and activate the cloud runtime misconfiguration scan.
  • Integrating with AWS
  • Integrating with GCP
  • Integrating with Azure
• Configure and activate DAST scans and pen-testing tools.
  • WebApp vulnerabilities scan configuration guide
  • API vulnerabilities scan configuration guide
• Configure and activate SCM branch protection verification and enforcement configuration guide.
• Add resources and expand your security coverage Manage Resources guide.
• Add users and give them a role Users and Permissions guide.
• In the Jit platform - go to the Security Impact page.

👍

Feel free to explore more of the Jit platform. Jit offers a wide variety of features beyond the items in this list.