Integrating GHAS with Defender for Cloud — quick notes
GHAS + Defender integration — quick notes
| Path | Role |
|---|---|
| Imported GHAS findings | GHAS/CodeQL generates the alert |
| Defender correlation | Adds cloud/runtime context, cross-provider aggregation, ownership, and status |
| Other Defender scan paths | Agentless code scanning and Microsoft Security DevOps in-pipeline scanning |
Current prerequisites: GitHub connector already created · GHAS on connected repositories · Defender CSPM enabled. Security Copilot is optional.
Workflow: connector onboarding → repository discovery → post-connection validation.
Traps
- Importing a GHAS alert does not make Defender rerun CodeQL.
- Inventory with no results has several possible causes; check processing time, artifacts, configuration, scope, permissions, and Advanced Security status.
- Remediation can be coordinated through issues, campaigns, and optional proposed fixes, but changes are not silently applied.
Primary sources: https://docs.github.com/en/code-security/concepts/code-scanning/codeql/codeql-code-scanning · https://learn.microsoft.com/en-us/azure/defender-for-cloud/github-advanced-security-deploy · https://learn.microsoft.com/en-us/azure/defender-for-cloud/quickstart-onboard-github · https://learn.microsoft.com/en-us/azure/defender-for-cloud/agentless-code-scanning · https://learn.microsoft.com/en-us/azure/defender-for-cloud/devops-support · https://learn.microsoft.com/en-us/azure/defender-for-cloud/github-advanced-security-overview