Custom secret scanning

[samigt]

Hi team,

Modifying a custom secret scanning signature is very disrupting and the confirmation message is misleading, as the action closes/deletes all alerts and recreates them.

It would be appreciated if the behaviour can just close alerts that no longer match - which is what the confirmation message states.

Regards,
Sami

[15MariamS]

Hi @samigt,

Thank you for the feedback! Secret scanning currently closes all associated alerts with the original pattern and then reopens alerts that match the new pattern. But yes - I agree with your expectation of how the feature should work!

While not yet solving the problem you described, we're working on a timeline feature that will help our users understand that the alert was closed because the original pattern was edited while also seeing the subsequent reopened event in context. We'll work to further improve this experience and, in the meantime, we'll clarify the confirmation text to set better expectations.