Full transcript
0:07Hey everyone. Thanks for joining us for
0:09the next session of our spotlight on
0:11GitHub Advanced Security series.
0:14My name's Anna. I'll be your producer
0:15for this session.
0:16I'm an event planner for Reactor joining
0:18you from Redmond, Washington.
0:21Before we start, I do have some quick
0:22housekeeping.
0:24Please take a moment to read our code of
0:25conduct.
0:27We seek to provide a respectful
0:28environment for both our audience and
0:30presenters.
0:32While we absolutely encourage engagement
0:34in the chat, we ask that you please be
0:36mindful of your commentary, remain
0:37professional and on topic.
0:40Keep an eye on that chat. We'll be
0:42dropping helpful links and checking for
0:43questions for our presenter to answer
0:45live.
0:47Our session is being recorded. It will
0:49be available to view on demand right
0:51here on the Reactor channel.
0:54With that, I'd love to turn it over to
0:56our speaker for today. Laura, thanks so
0:58much for joining
1:01Hey everyone. Thanks so much for being
1:03here. Super excited to be hosting
1:05another Reactor series talking about um
1:09application security and more
1:10specifically GitHub Advanced Security
1:12for Azure DevOps and going through all
1:14of the uh great changes that we've been
1:17shipping over the past year as well as
1:19giving you a heads up as to what's
1:21coming for GitHub Advanced Security for
1:23Azure DevOps or GASDO um as we call it
1:26for short. So you'll hear me refer to
1:28the product as GASDO throughout this
1:29presentation. Um all that means is
1:32GitHub Advanced Security for Azure
1:33DevOps is just a little bit of a longer
1:35name.
1:36So I'm excited to go ahead and jump
1:39right in. As Anna mentioned, um if you
1:41have any questions or comments, please
1:43drop those in the chat and we can
1:46definitely pause and take a second to
1:48address those.
1:51So here's our brief agenda for this
1:54morning or afternoon or evening
1:56depending on where you are in the world.
1:58Um so I'll briefly cover what GASDO is
2:00if you haven't heard about the product
2:02before or if you're a little bit newer
2:04to the product and don't have as much
2:05familiarity. We'll go over basically
2:08what tools are a part of GASDO and what
2:10you get with GASDO.
2:12Uh then I'll go and move up forward and
2:14talk about the things that we've shipped
2:16over the past year or so since our
2:18previous Reactor series.
2:20This will be a more hands-on demo. So of
2:23course with any live demo,
2:25provide some grace and hopefully
2:27everything works. Um but we'll be
2:29covering a lot of features that have
2:31been shipped and added into the product
2:34since last year.
2:35And then finally, we'll wrap up with a
2:37little bit of a sneak peek at what's
2:38next and happy to answer any other
2:41questions that are not addressed
2:43throughout the scope of the presentation
2:45at that point in time once you're at the
2:46end.
2:49So great to see people from across the
2:52world in England even. Um San Diego, San
2:55Jose, awesome. I am up in Seattle. Of
2:58course, we are usually cloudy but today
3:00we have sun so it is feeling like a
3:02great day.
3:04Um
3:05but always jealous of everyone in
3:06California with all that great sun.
3:09>> [gasps]
3:09>> Um all right. So let's first cover what
3:12GASDO is.
3:14If you aren't familiar with GitHub
3:15Advanced Security for Azure DevOps, this
3:17is native security scanning that's built
3:19into the uh
3:20scope of Azure DevOps.
3:22So this is originally um or started as a
3:25product over on the GitHub side called
3:27GitHub Advanced Security if you've heard
3:29about it. Um so GitHub Advanced Security
3:31integrates with GitHub. GitHub Advanced
3:33Security for Azure DevOps integrates
3:35with GitHub or sorry, with Azure DevOps
3:37um on the Azure DevOps side.
3:40So we have the same great tooling that
3:42you find over on GitHub Advanced
3:44Security uh just in the context for
3:46Azure DevOps. So we have secret
3:48scanning, code scanning and dependency
3:49scanning as our fundamental tools that
3:52we support in product as well as
3:54reporting and visibility options.
3:57So in the secret scanning world, this
3:58helps you detect exposed credentials in
4:00your repositories and also block secrets
4:03before they end up being exposed into
4:05your repository with a nifty feature
4:07called push protection that we have.
4:09Um and we have a over 100 partner secret
4:12patterns and we detect probably close to
4:14300 different patterns um across the
4:17product as well in general.
4:20For code scanning, you can find security
4:22vulnerabilities and coding errors in
4:23your source code using CodeQL static
4:25analysis. This uses the GitHub's CodeQL
4:28engine and uh runs in the context of a
4:31pipeline over on Azure DevOps.
4:34And then lastly, for dependency
4:36scanning, this helps you find
4:37vulnerabilities in your open source
4:38packages across a variety of ecosystems
4:41and we use the GitHub security advisory
4:44database to power all of our alerting
4:46needs.
4:49So across those three tools, of course,
4:50you have the developer perspective of
4:52going in to address all these findings
4:55that are occurring in your repositories.
4:57But we also have reporting and
4:58visibility built in into the product and
5:01through some collaborations with other
5:03teams across Microsoft like Defender for
5:05Cloud to give you a little bit more
5:07insight into what's going on across your
5:09enterprise or across your organization
5:11in the context of Azure DevOps.
5:13While the Defender for Cloud will give
5:15you that cross-enterprise security
5:16posture management if you're looking for
5:18something a little bit broader and
5:20holistic across all of your ADO
5:21organizations.
5:24Just a small callout to that Defender
5:26for Cloud also integrates with GitHub.
5:28So if you are on both platforms, if you
5:30have some repos on Azure DevOps and some
5:32on GitHub and both are using GAS, GitHub
5:35Advanced Security or GASDO uh Advanced
5:37Security for Azure DevOps, both of those
5:39will integrate nicely with Defender for
5:41Cloud as well to give you that posture
5:43management across both platforms as
5:45well.
5:47I'll pause there to see if there's any
5:49questions
5:51um before diving in into a quick
5:53overview of the roadmap from the past
5:56year and then a hands-on demo as well.
6:03Great.
6:06Let's talk about what we've shipped in
6:08GASDO over the past year.
6:11You can find all of these items on our
6:13release notes. There'll be a link to the
6:15release notes at the end of the
6:16presentation to uh help you catch up if
6:18you wanted to dig through these.
6:20But here is also just a high-level
6:22overview of what's been shipped over the
6:23first half of 2025, the second half of
6:262025, and then some of the early
6:28features that are coming in 2026
6:30already. Um
6:32that you can start to find in product.
6:36I know there's a lot of features here.
6:37So in the demo, we'll cover all of the
6:39biggest hits. I can quickly walk through
6:41some of these features um from left to
6:44right, top to bottom just so everyone
6:46has all the right context of what we've
6:48been doing and what we've been up to
6:49over here in GASDO land.
6:52So starting from the top left with
6:54security overview enhancements,
6:56we've added a a few columns into the
6:59security overview. Previously, it was a
7:01pure alert count um overview. But with
7:05the new enhancements, we've added
7:07columns that are sortable and also gives
7:09you more insight into new introduced
7:11alerts, fixed alerts and dismissed
7:13alerts across repositories in your
7:15organization so that you can be a little
7:18bit more aware of what actions your
7:20developers are taking and the state of
7:22repositories across your organization.
7:26Second on that list is multi-repo
7:27publishing support. Uh some customers
7:30used a single pipeline template across
7:32multiple repositories and we implemented
7:35support for alerts to get routed to the
7:37correct repository. Previously, these
7:39alerts would all be published into the
7:41pipeline or into the repository that
7:43contained the original pipeline. So with
7:46the multi-repo publishing support, these
7:48alerts are all correctly funneled into
7:50the appropriate repository that is
7:51checking out the pipeline rather than
7:53one central collated repository.
7:57Thirdly, in the first half of 2025 as a
8:00fun feature, we also released service
8:02hooks for alert events. So in Azure
8:04DevOps, you can set up service hooks to
8:07create events for certain um triggers
8:09within Azure DevOps.
8:11With this feature addition, you can
8:13create triggers for both alert creation
8:16events. So if you have a new secret
8:18alert that appeared and you want to
8:20stamp that immediately
8:21or if there's a state change. So say you
8:23want to check if someone has been
8:25dismissing alerts, you can set up an
8:26event hook across projects
8:29to notify you if someone has dismissed
8:31an alert.
8:34In the second half of 2025, we had a
8:36couple of larger features that were
8:38released as well that the team had been
8:40working on.
8:41So first that I'll also show in my demo
8:43is the availability of secret protection
8:45and code security as product offerings.
8:47Previously, before June 2025, when you
8:50purchased GASDO, it was an all-in-one
8:53bundled product. So once you purchased
8:54the product with a license, you got all
8:58features available to you. So all the
8:59secret scanning, code scanning and
9:02dependency scanning tools.
9:04And with the availability of secret
9:06protection and code security, that gives
9:07you a little bit more flexibility over
9:09your purchasing options and allows you
9:11to protect the repositories that you
9:13want with the right level of security.
9:16So for example, you can independently
9:18purchase secret protection to give you
9:19the secret scanning and push protection
9:21and validity checking features. Well,
9:23you can also separately purchase code
9:25security or bundle it with secret
9:26protection for the same repo to also
9:29gain the great code scanning and
9:31dependency scanning features for that
9:33repository.
9:34The price if you buy both is the same as
9:36the bundled options. The main difference
9:39is that you just get more flexibility
9:41over if you want secret protection
9:42versus code security or both for a
9:44selected repository.
9:48Second on this list is work item
9:49linking. So we know that of course folks
9:53all work differently. Um some people
9:55like to work out of the alerts context
9:57within the Gazdo
10:00views. Others work very diligently out
10:03of work items. So, given this, we
10:06release the ability for you to link a
10:08work item from a Azure DevOps boards to
10:12a advanced security alert.
10:15Next on that list, secret validity
10:16checking. You can see if secrets have a
10:20active status to them. So, to help give
10:23you more prioritization on your alerts,
10:25you can get a sense of what to
10:27prioritize if an secret is still active,
10:29you definitely know to go ahead and
10:31chase that down.
10:33Um last thing I want to highlight in the
10:34second half of 2025 here is one-click
10:37enablement for dependency scanning.
10:39So, we've been hard at work to make
10:41enablement experiences better for you
10:43within the context of Gazdo.
10:45And this feature allows you to easily
10:47get up and started with dependency
10:49scanning by automatically injecting
10:51dependency scanning as a build task into
10:54your pipelines. So, once a pipeline runs
10:56and you have this feature enabled, you
10:58would automatically get the dependency
10:59scanning task injected into that
11:01pipeline and running in your uh
11:03repository.
11:06Now, moving over to the 2026 column,
11:08there are some things that I'm also
11:10super excited about and we definitely
11:11will touch upon in the demo. Again, I
11:13know this is a lot, so bear with me
11:15here. We'll dive through all these
11:16features in a little bit more depth um
11:18in just a few moments as we move over
11:20into the demo.
11:22So, in early 2026, we've been working on
11:24a few key features. The first one I want
11:27to call out is the CodeQL default setup
11:29uh experience. If you are familiar with
11:31Gaz on GitHub, um they've had this
11:34feature live for a while with a lot of
11:35great success. And so, we definitely
11:36wanted to bring this over to Gazdo.
11:39This CodeQL default setup feature is
11:41similar to a one-click enablement
11:43experience for CodeQL
11:45and allows you to easily get set up with
11:46CodeQL and it also runs the scan on your
11:49behalf automatically on a weekly
11:51schedule.
11:52So, without needing to do any additional
11:54setup beyond enabling the feature and
11:56selecting agent pool depending on your
11:58needs, you can go ahead and get
12:00automated security scanning
12:02and the results funnel back for you um
12:04all in
12:06an easy format.
12:09The next thing I want to highlight is
12:10status checks via branch policy. Um we
12:13will also definitely demo this, of
12:14course. This allows you to implement a
12:17native security gating with Gazdo to
12:19prevent new vulnerabilities from being
12:20found and pushed into your repositories.
12:24Lastly, we also launched the private
12:26preview for a combined alerts dashboard
12:28and the security overview so that you
12:30can see all of your alerts and
12:31everything that you need to tackle in
12:34one view across your organization.
12:37All right, I know that was a ton of
12:39talking, a lot of items on this list
12:41here. Again, I'll give you a couple
12:42moments just to digest any other
12:44features on this list.
12:46If there's anything that I didn't cover
12:47that you're interested in, definitely
12:49drop that in the chat and I can take a
12:51look.
12:54But other than that, we will go ahead
12:55and jump right into one of my demo
12:57environments and we can walk through um
13:00some of the great features that I've
13:02been just talking about.
13:04So, I'm over in Azure DevOps. I have my
13:06demo or test environment.
13:09Again, everything is live, so hopefully
13:11everything works out for me today. But
13:13I'm going to go over into organization
13:15settings to get started
13:16and pop over into my repositories
13:19setting.
13:21So, in here I wanted to briefly show you
13:23here is the state for
13:26uh a new user if you're coming into
13:28advanced security for the first time
13:29right now.
13:31You'll see that you have options for the
13:33secret protection and code security.
13:35So, if you want to enable advanced
13:37security for your existing repos, you'd
13:39go over here to click enable all
13:42and then you have all these great
13:43options of some flexibility of what you
13:46want to end up protecting.
13:48So, you if you want to just purchase the
13:50secret protection plan for all your
13:52repos, you can uncheck the code security
13:54plan
13:55and this will go ahead and enable just
13:56secret protection for you.
13:58Once you hit apply, there'll be a
14:00billing confirmation dialogue, so you're
14:01not just jumping right in
14:03and you can see how many new committers
14:05you would add if you enabled um
14:08that plan for your select number of
14:10repos or all of your repos in this case.
14:13So, once you go ahead and click update
14:15billing, that'll trigger the enablement
14:16that you
14:18uh have selected including all the sub
14:20features.
14:21You can also see here under the pane
14:23that I have this new starting state for
14:25new projects
14:26um card.
14:28What this does is that you are able to
14:30select
14:32what what what happens for new projects
14:34that are created in this repo. So, if
14:36you toggle both of these on, that means
14:38when you create new projects, you'll
14:39automatically be protected by advanced
14:41security, which is a great option if you
14:44want to really have a strong security
14:46posture and
14:47bring forward all the enablement
14:49settings that you've had for existing
14:51repos.
14:52So, you can toggle these on and off
14:55and you can also configure by going into
14:57this options panel
14:58any optional configurations that you do
15:00or don't want to add.
15:02So, by default for secret protection, we
15:04bring in push protection for you. This
15:06will block any commits that contain
15:08supported secrets by our secret
15:10protection um or secret scanning tool.
15:13And over in the code security plan
15:14space, if you click into options, you'll
15:17also see a couple other um optional
15:19configurations that you can set up as
15:21well as things that are always available
15:22for you.
15:26So, that's the high-level enablement
15:28flow. You can enable these features at
15:31all levels. So, here I'm showing you the
15:34organization level view
15:35but you can also go into the project
15:37level view and get the same level of
15:39configurations.
15:42Going over into project settings.
15:47Oops, sorry. That's the repos. Going
15:48into project settings, you'll see the
15:50exact same advanced security card and
15:52then as a pre-emptive spoiler, you can
15:54also see those same options in the
15:56repository level card as well.
15:59Um I see a question in the chat about
16:01being set in the CLI.
16:03I know you can set it via API
16:06um because these are all exposed as API
16:08options and you can find those API
16:10documentations on Microsoft Learn as
16:12well.
16:13In terms of CLI, I don't believe we
16:15explicitly expose those via CLI. So, if
16:18the CLI has an option to um specify
16:22different APIs, then you can do that.
16:24But if not, then I believe at this time
16:26it is not exposed via CLI for um
16:30explicit controls there. The best option
16:32if you wanted to do something
16:33programmatically, I believe would be via
16:34API.
16:37Thanks for the question.
16:42>> [snorts]
16:42>> All right, so we're going ahead and we
16:45have advanced security enabled on both
16:47sides for secret protection and code
16:49security for the purpose of this demo
16:52and I'll briefly show you what that
16:53looks like in the context of Azure
16:54DevOps.
16:56So, to find the advanced security view,
16:58it's under the repos sidebar navigation
17:01and we have this new advanced security
17:04shield icon and tab.
17:07So, I'll go ahead and click advanced
17:08security and you can see immediately
17:10that I'm brought in with the context of
17:11a lot of alerts for this repository.
17:14You'll first land on the secrets page.
17:16If you're scanning a new repository, it
17:18may take a few minutes when you first
17:20enable advanced security or when you
17:22first enable secret scanning
17:23specifically to go ahead and crawl
17:25through your entire repository and pull
17:27back alerts for you.
17:30So, there's a few things that I want to
17:31highlight for you right off the bat as
17:33you land into this secret scanning page.
17:35You can see that some of these um
17:38some of these have an additional badge
17:40next to them. For example, this Twilio
17:41API key credential has this little
17:44active icon next to it while these other
17:46ones do not.
17:49The reason for that is we have
17:51introduced secret validity checking as I
17:53mentioned in that previous roadmap slide
17:55uh in the middle of last year.
17:57What this means is that we performed a
18:00call out to the Twilio service. This key
18:03is still active that is highlighted in
18:05this repository
18:06and I can go ahead and re-verify the
18:09secret to make sure
18:11hey, is this actually still active?
18:13Or you can also go and close the alert
18:14if you know that you've revoked the
18:16secret. All secret alerts do require
18:18manual revocation just because the
18:21secret needs to be revoked rather than
18:22just automatically removed from the
18:24code.
18:26You can revoke it and then once it's
18:28been revoked, you can go ahead and
18:29re-verify the secret to make sure that
18:31this turns from active um
18:34to a different state just to confirm
18:36that you've done the correct fix here.
18:41The other thing I want to highlight if
18:43you are an existing Gazdo customer is
18:45that previously we only had the high and
18:47other filter, but we've also introduced
18:49this confidence filter for all in the UI
18:52such that you can see all of your secret
18:53alerts in one context
18:56rather than needing to navigate between
18:58these two.
18:59By default, we land you on the all
19:01confidence filter.
19:03The other thing that you'll see in this
19:05view is this links column. So, it is
19:07suspiciously empty here, but this is how
19:10you'll see any linked work items in your
19:12organization.
19:14So, if you wanted to link a work item,
19:15you can click this add button over here.
19:18Because this is a new environment, I
19:20think I don't actually have any existing
19:21work item, so we can quickly create a
19:23new work item just to show what this uh
19:26linkage looks like.
19:28So, let me create a new item.
19:37So, you'll see this is work item number
19:39nine.
19:40Then when I go back here, I can search
19:42by
19:43oops, I can search by nine
19:45and it automatically linked it because I
19:48pressed enter.
19:49Um so, when you search for that work
19:51item ID, it'll pop up. And then you'll
19:53see the contents of that work item
19:55[clears throat] in your advanced
19:56security alert.
19:58You can also remove the link, but the
19:59other thing I wanted to mention is that
20:00it is bidirectional. So, regardless of
20:03whether you're linking this from
20:06advanced security or you're linking this
20:07from the boards UI,
20:09you'll see this new security alert item
20:12pop up, and this will be that linked
20:14advanced security alert. So, from the
20:15boards context, if you wanted to link,
20:19you can go ahead and click this add link
20:22existing item. Link type is security
20:24alert.
20:26And then navigate to the repo, and then
20:28you have your list of all the security
20:30alerts that you wish to link as well.
20:32So, I just linked this Azure DevOps PAT
20:35token. If I click this link, it'll lead
20:38me into the alert.
20:42And
20:45it looks like this did not quite work as
20:46expected. You should see this appear as
20:49an automatic work a linked work item as
20:52well.
20:58All right. So, that is the work item
20:59linking and the secrets alerts.
21:03Going over into the dependency scanning
21:05and code scanning.
21:08So, dependency scanning it looks like
21:09it's not quite set up. So, this is what
21:10the the default screen will look like
21:12again if you're a new customer
21:14and haven't run a scan before.
21:17You'll be led to documentation on how
21:19you can get started with dependency
21:21scanning or whatever the tool may be,
21:22whether that's secrets or code scanning,
21:25and help get you set up.
21:28Moving over into code scanning, we'll
21:30come back to the dependencies and see if
21:31I can find a good view for there.
21:36On code scanning it'll look pretty
21:37similar. You have slightly different
21:39filtering options here in the view.
21:41But of course, um
21:43as I mentioned earlier or alluded to
21:44earlier, code scanning and dependency
21:46scanning run in the context of a
21:47pipeline. So, secret scanning will
21:49trigger automatically for your
21:51repository once you enable secret
21:52protection, but for the code security
21:55features of dependency scanning and code
21:56scanning, you will need to run these
21:58tasks tasks in the context of a
22:00pipeline.
22:01So, if I go back over into my files,
22:05I have this azure pipelines.yaml file.
22:08And you can see that I've added the code
22:11QL tasks here.
22:13So, for code QL, we have two tasks that
22:15you need to run this advanced security
22:17code QL init task, which basically
22:19initializes the
22:21options for you, and also the analyze
22:23task. So, the analyze task is what
22:26actually runs through your code base and
22:29analyzes the rule sets that we have in
22:31the code QL CLI or the code QL tool
22:35against the code that we've detected and
22:37identified via the initialize task.
22:41Let me actually go over into the
22:42pipelines UI to show you a little bit
22:44better
22:46what this looks like and also getting
22:47set up with
22:49the advanced security tasks themselves.
22:52So, I'm over in Sorry, apologies. I'm
22:55over in the pipelines UI with my
22:57pipelines.yaml.
23:01So, I have my existing code QL
23:03initialize and analyze tasks, and if I
23:05wanted to also scan for dependency
23:07scanning, I can just go over here,
23:09select the dependency scanning task, and
23:11add this into my pipeline.
23:13And that's basically all you have to do.
23:15Dependency scanning is a pretty isolated
23:17task. So, once you have added it into
23:19your pipeline, you can go ahead and now
23:21read and save that.
23:22And I think I have to create a new
23:24branch.
23:25Add dependencies.
23:30So, for the sake of this demo, I won't
23:32go ahead and kick off a pipeline because
23:33it'll take a few minutes to run.
23:35But you can see that it's really easy to
23:37get started even in a manual setup
23:39scenario if you're just testing things
23:41out.
23:45Also alluding to
23:47two other great features for code
23:49security and
23:51dependency scanning.
23:53I'm getting feedback that the text on
23:55the screen is a little blurry. Let me
23:57see
23:59if zooming in here helps a little bit.
24:02Is this a little bit more legible for
24:05the demo?
24:07Apologies.
24:14So, I showed you how you can manually
24:15set up
24:17dependency scanning and code QL.
24:20Going into the code security settings,
24:22you can also check these default setup
24:24options. So, these are the one-click
24:26enablement options that I was mentioning
24:29earlier again in the road map
24:31or the
24:35the
24:37released feature section.
24:39These will allow you to get easily set
24:40up without needing to do any custom
24:42configuration.
24:44So, dependency alerts default setup will
24:46automatically add the task into your
24:48build pipeline. You will still need to
24:50run the pipeline that this is injected
24:52into to make sure that the scan runs.
24:55However, for code QL alerts default
24:56setup, this will run automatically on
24:58your behalf. So, I could go ahead and
25:00click trigger run now if I wanted to,
25:02and this will automatically kick off a
25:04job on the Azure pipelines pool for me
25:07with C# as my detected language for this
25:10repository.
25:13So, I can go ahead and click apply to
25:15apply those settings.
25:20And then we can also look at triggering
25:22this pipeline again just to see
25:25what the dependency scanning default
25:27setup looks like.
25:34So, it might take a second to kick off
25:36this job here.
25:39And maybe we can come back to this in
25:41just a second.
25:44So, I'm now back in the repository view
25:46with code scanning.
25:50I'll click into the alert view just to
25:51show you what it looks like. It looks
25:52pretty similar just like the secret
25:54scanning alert. You have your
25:56alert details here at the top, a little
25:58sidebar with some additional details.
26:00You can link work items here, and then
26:03here is all the descriptions and
26:05recommendations of how to fix the alert.
26:09The other thing I forgot to mention is
26:11of course you can dismiss alerts. In in
26:14Gazdo, we do have an additional
26:16permission here. So, if you want to add
26:19additional controls around who has the
26:20permissions to dismiss alerts,
26:22you can go ahead and customize that for
26:24different roles.
26:26And you can specify if it's risk
26:28accepted or false positive and also add
26:30a comment.
26:34And this dismissal
26:37will process.
26:43Let's go ahead and check back in on our
26:45pipeline job.
26:50Great. So, you can see that the pipeline
26:52has started to kick off already.
26:54And we have the tasks that I defined. We
26:57have the code QL init task, the analyze
26:59task, and the publish task.
27:02And then we also have these
27:03auto-injected tasks, which is because we
27:06have this setting a couple of other
27:07times. So, in your organization it
27:09should only show up once.
27:11This auto-injected task is a default
27:13setup feature for dependency scanning.
27:15It automatically pushes it into your
27:17pipeline so that if you have the feature
27:19enabled, it'll automatically
27:22trigger and run the scan in the context
27:24of your pipeline as well.
27:26The last thing I forgot to mention with
27:29the build tasks is the advanced security
27:31publish task.
27:32Let me go back over into pipelines just
27:34so we have a little bit of a nicer view.
27:37And what this publish task does is that
27:38it allows you to submit arbitrary SARIF
27:41from any third-party tool that produces
27:43SARIF and receive the results in the
27:45context of advanced security.
27:47So, if you have something like a Trivy
27:49that you use for container scanning or
27:51here I have template analyzer for
27:53example,
27:55the results from the template analyzer
27:57task will be picked up via the advanced
27:58security publish task, and it'll publish
28:01that into the code scanning tab for you
28:03so that you can have all your results in
28:04one view
28:05without needing to go into different
28:08results
28:10um
28:11tools.
28:13So, I see one question in the chat here
28:14asking, "Do these features have a cost
28:16if I activate them in my Azure DevOps
28:18organization?"
28:19Yes, they do. So, when you
28:22enable these for a new repository, there
28:25will be a billing dialogue confirmation
28:27as well to show you and indicate how
28:29many
28:30new committers these
28:32will add.
28:33So, for example, here I have three new
28:35committers if I enable the plan for this
28:38repository.
28:40You can find an estimate for your bill
28:42by going to the Azure pricing calculator
28:44that's linked here.
28:45But I can also cover billing. So,
28:48these plans are billed per unique active
28:51committer per plan.
28:53If you're on the existing Gazdo plan,
28:56new customers should not need to be
28:58there, so I won't mention that. But if
28:59you have questions on the bundled Gazdo
29:01plan, let me know.
29:03If you are activating secret protection
29:05and code security, secret protection
29:06will cost $19 per active committer per
29:08month,
29:09and code security will cost $30 per
29:13committer per month.
29:15So, if you're enabling both of these
29:16plans, it'll be $49 per committer per
29:18month.
29:20Um
29:22and we do deduplicate committers at the
29:24Azure subscription level. So, even if
29:26you have multiple organizations,
29:27multiple projects, multiple repos, and
29:29the same user is committing to multiple
29:31repositories in that organization,
29:34as long as it's all billed to the same
29:36Azure subscription, we do deduplicate
29:39users across that. So, you only have to
29:41pay once even if they're working on
29:42cross multiple organizations
29:44and projects. Again, they just need to
29:46use the same Azure subscription for all
29:48those organizations that you're enabling
29:51advanced security for.
29:56Any other questions around cost there?
30:03Cool. The other thing I will say, active
30:05committer,
30:07um
30:08we do make sure that it's a user in your
30:10enterprise. So, if you're cloning open
30:12source, for example, we've gotten that
30:14question a couple of times. Hey, will I
30:16be charged for a a ton of committers
30:18outside of my enterprise? The answer is
30:21no. Um we do additional checks on the
30:23back end to make sure that it's relevant
30:26or users that are in your organization.
30:32Great.
30:33The last thing that I wanted to
30:35Actually, two more things I wanted to
30:36demo. So, one is the status checks
30:39experience.
30:40Um
30:42as I mentioned,
30:44a lot of folks want to set up some sort
30:46of custom gating or blocking policy to
30:49make sure that your repository stays
30:51secure. Of course, you don't want to
30:52introduce more security flaws.
30:55And what we're introducing and will be
30:57shipping in just a week or two now is a
31:00built-in status policy check for
31:03advanced security.
31:05So, I'm in the project level settings
31:07again.
31:08I'm going into policies
31:11and scrolling down to branch policies.
31:14So, branch policies are ways that you
31:15can configure protections against your
31:19default branch or any other branch that
31:20you care about
31:22to make sure that you're not introducing
31:24any flaws, vulnerabilities, or security
31:26concerns that you uh might have or care
31:30about. So, by default, it just sets up a
31:33protection for the default branch, but
31:34you can also specify any patterns. If
31:37you have release branches or some sort
31:39of naming convention, you can also
31:40customize that.
31:42For now, I'll go ahead and set this up
31:43to protect the default branch of each
31:45repository.
31:47And then this goes into additional uh
31:49findings where you have build validation
31:51and status checks.
31:54So, what build validation policies are,
31:55if you're not familiar, is that in the
31:57context of a pull request, it'll run a
32:00specific pipeline that you have
32:01specified against the pull request
32:03changes.
32:05For the context uh here, to per- to
32:09perform pull request gating, you will
32:12need to set up a build validation
32:13policy.
32:14So, this is using the same pipeline that
32:16I had demoed earlier. This one has the
32:18code QL tasks in it and also the
32:20auto-injected dependency scanning task.
32:23And I will set this as required to make
32:25sure that, you know, the
32:27findings from any pull requests
32:30are
32:31going to show up for me.
32:33I'll click save.
32:35So, I now have a build validation policy
32:37set.
32:39I'll show you what it looks like without
32:41a status check enabled. I can go over
32:42into a pull request.
32:46Let's see if I need to create a new pull
32:47request. I do need to create a new pull
32:49request.
32:51So, I'll just merge in one of my random
32:54test branches.
32:58And you can see now I have this pipeline
33:00run. That's the the build is running,
33:02it's queued, and this pull request,
33:05um if I want it to be required, will
33:08wait until this pipeline run is done.
33:11So, it'll basically evaluate all the
33:12changes on this pull request and run all
33:15the same scans in this pipeline that
33:17I've defined
33:18for this pull request context.
33:23Clicked into a little bit too soon, so
33:25the
33:26jobs are not fully outlined, but here
33:28you can see code QL in it, analyze
33:30analysis, and the publish task as well.
33:35So, jumping back to the pull request
33:37again,
33:39or sorry, jumping back into the stat- uh
33:41the
33:42branch policies again. So, that was
33:44setting up a build validation policy.
33:46This is step one in order to an
33:48implement gating.
33:50Step two is to add a status check.
33:53So, you need to manually add in the
33:55genre and name for the first time in
33:57which you're using the status check. The
33:59genre is going to be advanced security,
34:01and then the name that you want to set
34:03is all
34:06high and
34:08criticals.
34:13Click save. There's also additional
34:15advanced options if you want to
34:17customize those.
34:21Um and so now I have the status check
34:23that will run.
34:25So, if I go back into this
34:28pull request, you can see previously I
34:30just had that build validation policy
34:32running. Now I do have two checks.
34:35Um one is
34:40Maybe I need to create a new pull
34:41request again. New pull request.
34:43Um
34:48creating another demo branch.
34:53So, it'll queue up this build validation
34:56policy, and it looks like
35:00this is not queuing as expected, so
35:04>> [gasps]
35:05>> live demos are always fun.
35:07>> [snorts]
35:07>> Um let me pull up a backup that I have
35:10here
35:11um to see what is going on.
35:18So, Anna, I'm going to share another
35:21screen in just 1 second.
35:23Um if you could go ahead and move us
35:26over there.
35:32So, this is a backup demo environment
35:34that I have.
35:37Um so, you can see
35:38I have this additional check configured.
35:42Let me expand this so you can see. Um
35:44that says advanced security alerts with
35:46severity of high or above must be
35:47resolved.
35:50And if you scroll down, you'll see it
35:52shows exactly what the uh po-
35:55the alerts that are violating that
35:56policy are. So, you have the specific
35:58alert IDs, and then when you click into
36:00these, it'll take you into the alert
36:02context as well. So,
36:04going over into here,
36:07you can see this uh alert is violating
36:09the uh branch policy that we've set up.
36:15When you click on this alert, it'll just
36:16lead you to our documentation. So,
36:19if you click this, it'll go over into a
36:21Microsoft Learn link uh of more details
36:24about what the status check policy
36:25itself is.
36:29I'll pause there. I know I covered a lot
36:31of content um around just how to get a
36:34set up with how to set how to get set up
36:36with Gazdo um enablement and a quick
36:40walk-through of going through the
36:42advanced security pages and alert detail
36:44views.
36:48In the meantime, I'll also switch back
36:50over into my other screen share to demo
36:52one last thing, um which is the security
36:56overview uh reporting functionalities.
37:03All right.
37:05So, a lot of what I covered was more
37:07from the developer perspective.
37:08Developers are going to be coming into
37:09the repos tabs and working out of the
37:12repo level of advanced security view to
37:14see, you know, what's going on.
37:18Of course, there's also the other side
37:19of the story where we have application
37:21security managers and wanting to get a
37:24little bit more context on what is going
37:26on across your enterprise or across your
37:27organization.
37:30So, once you navigate back into
37:31organization settings,
37:33under security, there's a security
37:34overview tab.
37:36Here we have three different panes: the
37:39risk pane, coverage, and alerts.
37:43I'll walk through each of these briefly.
37:45So, in the risk view, you can basically
37:47get a sense of what activity is going
37:49on. You have a column for open alerts, a
37:52column for new alerts, fixed and
37:53dismissed alerts.
37:55And you can see basically,
37:58you know, what is activity that's
37:59happening in a set period of time. So,
38:02over the past 7 days, 2 weeks, month, 90
38:05days.
38:06Um this will help give you a sense of,
38:08you know,
38:10what's coming into my organization, what
38:12are people fixing, and then also are
38:14there a large quantity of dismissed
38:16alerts for some reason.
38:19There's also additional filtering that
38:21you can do. So, if you care mostly about
38:22criticals and highs, for example, and
38:25you also want to look at code scanning
38:27alerts
38:28within a specific project, you can do
38:30all of that functionality.
38:32You can also see that all of these
38:33criterias are appended back into the
38:35view. So, if you have a specific filter
38:38criteria that you want to come back to,
38:40you can, of course, favorite this and
38:43load this up, and you'll see the uh view
38:47come back.
38:51Moving over into coverage, this will
38:52give you a sense of where are things set
38:54up and where do I have to do a little
38:56bit more additional configuration.
38:59So, you can uh
39:00filter by project, of course,
39:03and also state. So, if you are in the
39:05middle of rolling out secret scanning
39:07specifically, you can go ahead and say,
39:08"Okay, where do I have secret alerts
39:10disabled?" Um to know where you need to
39:12do a little bit more uh work.
39:16Or if you want to look at
39:19code QL alerts specifically, you can see
39:21where it's enabled and maybe where your
39:23repos are in good shape.
39:28And alternatively, where you don't have
39:30pull request alerts enabled, so that if
39:32you want additional protections, um you
39:34you know that you need to set up that
39:35build validation policy
39:37um to make sure that you're getting pull
39:38request alerts successfully.
39:42Another nifty feature that is being
39:44shipped right now is that you can export
39:46this finding back to CSV.
39:49Um this is via the UI only, but this is
39:51across all these pages. So, you can
39:53export to CSV for all of these, and I'll
39:56basically just pull the selected
39:58filtered table down um into a CSV for
40:01you.
40:02If you also prefer to work via API,
40:04again, all of these functionalities are
40:06available via API as well.
40:08Um it's the same API that powers these
40:10tables in the first place. So, you'd be
40:12getting the same exact experience if you
40:14want to work out of the um APIs instead.
40:21Uh I see a question in the chat. Is it
40:22possible to review a report of all the
40:24alerts fixed in a period of time greater
40:26than 90 days?
40:28Yes, you can use the alerts API to do
40:30this, and we will go over here in just a
40:32second. Um this is our newest tab, but
40:35basically the risk view is scoped to
40:38that set period of time um
40:41within the 90-day period, but the alerts
40:44tab will give you a little bit more
40:45flexibility if you want to do additional
40:46customizations or views um related to
40:50specific alerts and alert behavior.
40:54So, that is a nice segue into this demo
40:56here that the alerts view is again our
40:58newest view, and what this is is a
41:03list of all the alerts across your
41:05organization.
41:06So, it does infinitely scroll depending
41:09on how many alerts you have.
41:10Um
41:12By default, it is also available by API.
41:16You can reset filters and also export to
41:18CSV. The export, just to note for the
41:20alerts view, caps out at 1,000 alerts
41:22for now.
41:25The biggest and coolest thing that I
41:27want to kind of demo within the alerts
41:28view here is that uh this leads the way
41:32for a security campaigns-like experience
41:34if you are familiar with campaigns on
41:36GHAS.
41:37Um basically, you can create and save
41:39filters.
41:41And from there, you can use these
41:42filters to basically drive campaigns so
41:45that you can share these filters with
41:47your team and say, "Hey, I want to
41:50create a campaign targeting secret
41:51alerts that are active and making sure
41:54that these are the, you know, the
41:55highest priority things for my team to
41:57drive."
41:58So,
41:59you can open the advanced filter.
42:01You can also search by keyword if you
42:03have a specific keyword that you want to
42:05look for such as like PATs or Azure
42:07DevOps tokens.
42:09Um but for now, I'll just go into a
42:10secret alert. Make sure they're open.
42:13Severity all uh
42:15all
42:17secret alerts are critical by default,
42:19so I don't need to set up a critical um
42:21filter here, but you can.
42:23And you can also put in a first detected
42:25date. Let me refresh. Let me um a first
42:28detected date um if you want to focus
42:31your burn down on a specific set of
42:33alerts.
42:35As I mentioned, I want to look at active
42:37alerts specifically, so let me go ahead
42:38and apply this filter.
42:40So, you can see that I have a set of
42:41three alerts across two different
42:43repositories.
42:46I can save this filter.
42:54And you can see that in the top here,
42:56it's created a nifty filter ID or GUID
42:59for me.
43:01Um so, I can go ahead and open that
43:03filter, apply the filter.
43:06And it looks like this got a little
43:09buggy, so let me refresh this page.
43:12Um
43:15so,
43:16I can open this
43:18filter. You can see that it's a saved
43:19persistent state, the active secret
43:21alert burn down that I just created. And
43:23basically, what you can do is you can
43:24take this link and share it into a
43:27channel
43:29with all your devs.
43:30And because
43:32all these views are now are backgated,
43:35devs will only see the repos that they
43:37have access to or the repos that they
43:38work out of. So, for example, if you
43:41have two different projects and you have
43:43permission permission controls
43:44implemented, if you drop this into a
43:46channel, maybe your devs for the awesome
43:48test project will only see this
43:51uh SPMI-5 or 52 repo, and then everyone
43:53else working out of this other repo will
43:55only see this um demo test project um
43:58with the repo here as well. So, you can
44:00use this functionality to easily fan out
44:03and create basically campaigns to help
44:06drive remediation across your
44:08organization.
44:10And because it's a filter, it's also
44:11live. So, if any new findings come in,
44:15the filter will update to incorporate
44:17those alerts. So, for example, if
44:19tomorrow someone introduced a new active
44:21secret, this would then appear into this
44:23filter.
44:25And then as alerts get closed, you also
44:27see them disappear because they no
44:29longer match the open state of this
44:31filter.
44:33Um so, back to the the question around
44:35alerts fixed in a time period. Um I
44:37believe that you could use this alerts
44:39API here.
44:40You can filter to closed, look for
44:42fixed,
44:44um and use that to filter. So, for my
44:47repo, maybe I don't have anything here.
44:50Um but I could reset this, look at
44:52closed and fixed,
44:54and this will show up. So, if you want
44:56to customize your time period,
44:59um you can change the start and end
45:01dates as well.
45:03Again, this is available via API, too.
45:05So, depending on your workflow, if you
45:07want to work out of the security
45:09overview in the UI or if you want to
45:11work out of this uh via UI, that is all
45:15optional.
45:18Lastly, again, if you want to export
45:20your findings for some reason, you can
45:22export them um here, and it'll be the
45:25list of all the existing
45:28um alerts returned in this table view.
45:35Awesome. So, that was a very high level
45:37high level overview
45:39and all-encompassing demo of getting
45:41advanced security set up for your
45:43organization, walking through it as a
45:45developer, and also from the application
45:47security perspective, how you can start
45:49to monitor and build workflows out for
45:51your organization. So, starting from
45:54preventing additional risk from coming
45:55in via the status checks policy
45:58and build validation policies to get
46:00some pull request time context back to
46:03security overview to give you more
46:04coverage and overview of what's
46:06happening across your organization and
46:09giving you a little bit more power over
46:11what you want to look for
46:14across a couple of different pages.
46:18I'll pause to make sure that I am not
46:20missing any other questions
46:24um before jumping back over into the
46:26slides to give you a brief coverage of
46:28what's next on the road map for us.
46:34Great. Let's jump back over into the
46:36slides.
46:42So, again, if you wanted to check out
46:44any of these features, these are all
46:46available via via the release notes.
46:48And here is a high-level overview of all
46:51the things that we covered. A lot of
46:53things. All of these were mostly
46:55covered.
46:56Um
46:56so, there's a lot of new changes and
46:58things that we're constantly bringing to
46:59GHASDO to make your experience better.
47:04What's next on our road map?
47:08So, this is specific to Q4.
47:11Um of course, we have tentative plans
47:13further out in the future, but those are
47:15a little bit more tentative, so we don't
47:16have concrete timelines on when we're
47:18going to bring some of those additional
47:19features in.
47:20So, for now, I'll keep this scoped to
47:22Q4.
47:24If you want more details on
47:25future-looking road map, you can also
47:27find this via the Microsoft Learn site.
47:30Um there'll be a link to the release to
47:32the release notes, and from the release
47:34notes, you can also jump over into the
47:35road map um section on Microsoft Learn
47:38as well.
47:40So, in April, what we're shipping is a
47:42public preview of default setup.
47:44Currently, the default setup experience
47:46for CodeQL is in private preview, um but
47:48by mid-April, this feature will be
47:50broadly available for you. So, if you
47:52are not quite scanning via CodeQL quite
47:55yet or you don't have code scanning set
47:57up, and you want to give it a try, um I
48:00would highly encourage you to look out
48:02for the CodeQL default setup feature
48:04because it is super awesome, and I think
48:07will be a game-changer for helping you
48:09get set up and um easily using code
48:12scanning in the context of GHASDO moving
48:14forward.
48:16Next is that combined alerts dashboard
48:18view and the security campaigns or
48:20filtering experience. This is also
48:21currently in private preview, and will
48:23be moving to general availability around
48:25the same time frame at mid-April.
48:29The other two I briefly covered as well.
48:32We have um us some smaller improvements
48:34in the UI for alert UX at the repository
48:37level, and also the availability of
48:40exporting results from the security
48:41overview.
48:44Moving over into May, the main thing I
48:46want to cover is that CodeQL default
48:48setup will be moving from public preview
48:49into GA.
48:51Um we'll be making a few experience
48:53enhancements once it reaches general
48:54availability at that point in time, but
48:57the shape and feel of the experience
48:58will look or the look and feel of the
49:00experience will be the same as what
49:02you'll receive in public preview. So,
49:04again, highly encourage you to check out
49:06the default setup experience as it helps
49:08streamline your overall enablement um
49:10process.
49:13Moving over into June, we have a smaller
49:15enablement flow improvement to make that
49:17overall enablement experience that I
49:19showed a little bit more smooth between
49:21enabling existing repos and enabling
49:23settings for future repos.
49:26And then lastly, we're also looking at
49:28uh metrics. So, when I showed you the
49:30security overview pages, you definitely
49:32may have noticed that there is not a lot
49:34of um
49:36holistic metrics we're tracking there.
49:38So, one of the things that we want to
49:40build out in
49:41June is at least a preview phase with
49:44some rudimentary metrics to help you see
49:46burn down and some value of the Gazo
49:49tool across your organization.
49:53There are also a few other things that
49:55we're still thinking through through the
49:56quarter. So, definitely stay up to date
49:58on the road map or the release notes if
50:00there's any other features that you see,
50:02um, that might catch your eye. And also,
50:05I know that we will be making some
50:06announcements for Microsoft Build as
50:08well. So, if you, uh, will be attending
50:10Build or interested in Microsoft Build,
50:12that'll be another chance to catch some
50:14of the new Gazo features that are
50:15shipping or when what may not quite be
50:17finalized yet at at this point in time.
50:24All right. So, on the next slide, I
50:26believe we're almost there. The next
50:28slide will just cover briefly updates to
50:30the default setup experience,
50:32um,
50:34that you hadn't seen in the demo
50:37already. So, again, default setup is a
50:39one-click setup experience to help you
50:41get Code Churn running for your own
50:43repositories.
50:44Of course though, if you need additional
50:45control, you can continue scanning via
50:47your own pipelines or mix both.
50:50So, for example, with default setup, you
50:53have some controls for your entire
50:54organization.
50:56Um, moving into this, hopefully this is
50:59not too blurry. I know that may show up
51:01a little blurry,
51:02um,
51:03but we have this new accordion for Code
51:05Churn default setup configurable
51:06options. Um, once you enable Code Churn
51:10default setup, you can customize a few
51:12selections.
51:14Um, so in public preview, when you get
51:15started, you'll start running on the
51:17Azure pipelines automatically. However,
51:20you can have additional control if you
51:21don't use the Azure pipelines agent pool
51:24or if you don't if you have custom agent
51:26pools that you would prefer to run on,
51:27you can change the setting.
51:29And then you can also change the scan
51:31schedule. So, by default, it runs weekly
51:33on Mondays. You can adjust that date,
51:35um, to be any day so if you want to run
51:37it over the weekends for example to make
51:39sure that everything is scanning over
51:40the weekend, you can come back on Monday
51:43and have your results in for your
51:44organization.
51:48Um, but if these setups if these
51:50defaults don't work for you or if these
51:52configurations you need to customize for
51:54some repository for some reason, you can
51:56always go back in via the manual process
51:59and configure a YAML pipeline file with
52:03the same Code Churn tasks and run it
52:06manually for a trigger or context that
52:08works better for you.
52:16Perfect. So, that's all the content that
52:18I had today. Again, we covered what Gazo
52:21is briefly if you weren't familiar. Um,
52:23a high-level fast overview of some of
52:26the new features that we shipped in the
52:28past year.
52:29Uh, a quite lengthy demo,
52:31um, with all the things that we have
52:33been building. So, hopefully you can see
52:36some of those things in action that I've
52:37been talking about and some of the
52:38cooler features like default setup, um,
52:41and secret validity scanning you can
52:42secret validity checking you can go
52:43ahead and test out in your own
52:45environment if you are a Gazo customer.
52:48Um,
52:49and of course, there's always new
52:51improvements and feedback that we're
52:52looking for. So, if you are a current
52:54customer and want to connect, please
52:55reach out. I'd be happy to chat with
52:57you. Um, or if you're an interested
52:59customer or maybe have a few other
53:01questions, again, also please feel free
53:03to reach out, um, or work with your
53:05GitHub or Microsoft rep and they can get
53:07you the right answers or connected as
53:09well.
53:14So, here are some links to stay up to
53:16date on all things Gazo. I believe these
53:18have also been floating around the
53:20Reactor session. Um, so if you haven't
53:22caught them before, here they are.
53:25Um, I believe they'll also be pasted in
53:27the chat so you can access them or maybe
53:29not pasted in the chat but flown around
53:31as a banner. Yes, okay, YouTube
53:33description. Um, perfect. So, you can
53:36find those in the YouTube description.
53:38Um, the get started is a link to our
53:40documentation. So, if you're a new
53:42customer and need to configure things
53:44for the first time, go ahead to
53:46ak.ms/configure-gazo.
53:49Uh, the blog will be some, uh,
53:52the blog will have announcements or
53:54demos on some of the bigger features
53:56that we're releasing. So, when Code
53:58Churn default setup is released, you'll
53:59definitely see a blog there as well as a
54:01blog for the whole filtering experience
54:03that I demoed. Um, so you can follow
54:05along or just get more details on some
54:07experiences that you can configure
54:09through, um, those features.
54:12And then lastly, the release notes
54:13section, ak.ms/azuredevops/releasenotes,
54:16um, that'll be where we show and talk
54:19through or not talk through but have
54:21notes for all of the newest feature
54:22releases that are coming out as well as
54:24anything that may change between release
54:26to release. So, these are typically
54:28available every
54:30three or so weeks just due to how we
54:32ship over in the Azure DevOps land.
54:35So, bookmark that page, check it out,
54:37and stay up to date on anything new
54:39that's coming out.
54:41If you go to that release notes site as
54:43well, that'll be where you can find the
54:44road map. The road map is updated every
54:46quarter, um, so slightly less frequent,
54:49but the road map will also have, uh, the
54:52most up-to-date, uh, details on new
54:54features coming out. Not just for Gazo,
54:56of course, but for all things Azure
54:58DevOps. So, if you're over there, um,
55:00definitely make sure that you have those
55:02resources for you.
55:09Awesome. Well, thank you everyone for
55:11tuning in today. Again, if you have any
55:13other questions or comments, feel free
55:15to reach out. Um, happy to hear from you
55:18if you have anything that you want to
55:20share.
55:21Otherwise, thank you so much for tuning
55:22in. I hope everyone has a great rest of
55:24their day.
55:30Thank you all for joining and thanks
55:31again to our speakers.
55:34This session is part of a series.
55:36To register for future shows and watch
55:39past episodes on demand, you can follow
55:41the link on the screen or in the chat.
55:45We're always looking to improve our
55:46sessions and your experience.
55:49If you have any feedback for us, we
55:51would love to hear what you have to say.
55:53You can find that link on the screen or
55:55in the chat.
55:56And we'll see you at the next one.
56:19>> [music]
56:28[music]
56:34[music]
56:40[music]