You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Over the last 7 days, 94 firewall-enabled workflow runs across the github/gh-aw repository were analyzed, generating 4,343 monitored network requests with a healthy 2.0% block rate (87 blocked / 4,256 allowed). Blocking activity was heavily concentrated in a single event: Code Scanning Fixer (run 32851862995) triggered 53 blocked requests across 51 distinct domains — largely legitimate Go/npm/OS package-manager and CRL/OCSP infrastructure hosts (proxy.golang.org, registry.npmjs.org, archive.ubuntu.com, various certificate-revocation endpoints) — suggesting the firewall policy for that workflow may be too restrictive for its build/toolchain needs rather than indicating malicious traffic. The only domain blocked repeatedly across multiple workflows was registry.npmjs.org:443 (9 hits across CI Optimization Coach, Code Scanning Fixer, and Daily Go Test Parallelizer), a strong candidate for allowlisting if npm access is an expected dependency for these workflows.
No DIFC (Data Integrity and Flow Control) integrity-filtered events were recorded in the same window — the gateway found zero qualifying runs, so there is nothing to report on that signal this cycle. This is a positive result: it indicates no tool calls were flagged for integrity or secrecy violations, but the "Firewall Analysis" section below remains the sole substantive intelligence signal for this report.
🔥 Firewall Analysis
Key Firewall Metrics
Metric
Value
Workflows analyzed (firewall-enabled)
94
Total network requests monitored
4,343
✅ Allowed requests
4,256
🚫 Blocked requests
87
Block rate
2.0%
Total unique blocked domains
56
📈 Firewall Request Trends
Allowed request volume dominates the trend, consistent with normal MCP/API/telemetry traffic (api.githubcopilot.com, Sentry, Grafana). Blocked traffic is a small, sporadic signal concentrated on a handful of dates tied to the Code Scanning Fixer and Daily Go Test Parallelizer runs rather than a sustained daily pattern — no evidence of an escalating or persistent attack/misconfiguration trend.
Top Blocked Domains
registry.npmjs.org:443 is the clear outlier with 9 blocks spread across three workflows, indicating a systemic policy gap rather than a one-off. The remaining ~55 domains each appear once, nearly all originating from a single Code Scanning Fixer run and covering legitimate Go toolchain, Ubuntu package/CRL, and certificate-authority infrastructure — these look like standard build-time dependency/CA-check traffic that the firewall policy doesn't yet recognize as safe.
Most Frequently Blocked Domains
Domain
Times Blocked
Workflows
Category
registry.npmjs.org:443
9
CI Optimization Coach, Code Scanning Fixer, Daily Go Test Parallelizer
No individual rule-hit or denied-request attribution data was available from the audited runs this cycle (rule-level hit counters were empty across all 99 analyzed audits), so a per-rule breakdown table cannot be produced this period.
View Detailed Request Patterns by Workflow
Workflow
Allowed
Blocked
Code Scanning Fixer
120
53
Daily Go Test Parallelizer
92
21
CI Optimization Coach
72
3
AI Moderator
20
2
Delight
86
2
Architecture Guardian
14
1
Daily Copilot PR Merged Report
36
1
Daily Credit Limit Test
6
1
Daily Malicious Code Scan Agent
49
1
Issue Triage Agent
50
1
CLI Consistency Checker
100
1
Breaking Change Checker
114
0
Impeccable Skills Reviewer
346
0
PR Description Updater
540
0
Design Decision Gate 🏗️
234
0
View Complete Blocked Domains List
*.grafana.net (1)
*.sentry.io (1)
api.github.com (1)
api.githubcopilot.com (1)
api.snapcraft.io (1)
archive.ubuntu.com (1)
awmg-cli-proxy (1)
awmg-mcpg (1)
azure.archive.ubuntu.com (1)
crl.geotrust.com (1)
crl.globalsign.com (1)
crl.identrust.com (1)
crl.sectigo.com (1)
crl.thawte.com (1)
crl.usertrust.com (1)
crl.verisign.com (1)
crl3.digicert.com (1)
crl4.digicert.com (1)
crls.ssl.com (1)
github.com (1)
github.github.io:443 (1)
go.dev (1)
golang.org (1)
goproxy.io (1)
host.docker.internal (1)
json-schema.org (1)
json.schemastore.org (1)
keyserver.ubuntu.com (1)
ocsp.digicert.com (1)
ocsp.geotrust.com (1)
ocsp.globalsign.com (1)
ocsp.identrust.com (1)
ocsp.sectigo.com (1)
ocsp.ssl.com (1)
ocsp.thawte.com (1)
ocsp.usertrust.com (1)
ocsp.verisign.com (1)
packagecloud.io (1)
packages.cloud.google.com (1)
packages.microsoft.com (1)
pkg.go.dev (1)
ppa.launchpad.net (1)
proxy.golang.org (1)
proxy.golang.org:443 (1)
raw.githubusercontent.com (1)
registry.npmjs.org (1)
registry.npmjs.org:443 (9)
s.symcb.com (1)
s.symcd.com (1)
security.ubuntu.com (1)
storage.googleapis.com (1)
storage.googleapis.com:443 (1)
sum.golang.org (1)
ts-crl.ws.symantec.com (1)
ts-ocsp.ws.symantec.com (1)
www.googleapis.com (1)
🔒 Firewall Security Recommendations
Allowlist registry.npmjs.org:443 for CI Optimization Coach, Code Scanning Fixer, and Daily Go Test Parallelizer if npm dependency access is an expected part of their tasks — it is the only domain blocked across multiple workflows and multiple runs.
Review Code Scanning Fixer's network policy — it accounts for the vast majority (53 of 87, ~61%) of all blocked requests in a single run, spanning Go toolchain, Ubuntu package mirrors, and CA/CRL/OCSP endpoints. These are typical build-and-verify dependencies; if this workflow performs Go builds or Docker/package installs, its egress policy likely needs broader OS/toolchain domain allowances.
No suspicious or unexpected external domains observed — all blocked hosts are recognizable package registries, OS mirrors, or PKI infrastructure; no signs of exfiltration or C2-style domains this cycle.
Rule-level attribution data is currently unavailable in audit output; consider enabling policy rule-hit instrumentation so future reports can attribute blocks to specific firewall rules for faster tuning.
🔒 DIFC Integrity Analysis
No DIFC integrity-filtered events found in the last 7 days. The DIFC gateway log (filtered-logs.json) returned zero runs, and the warm-start cache snapshot was empty and current (updated within the analysis window), confirming this is a true absence of filtered events rather than a stale or missing signal. No charts, per-workflow, per-server, or per-user breakdowns are available for this period.
💡 DIFC Tuning Recommendations
No tuning action is required this cycle — zero integrity/secrecy filtering events indicates either low risk-triggering tool activity or effective upstream controls.
Continue monitoring; if DIFC event volume remains at zero for multiple consecutive cycles, consider validating that the gateway logging pipeline itself is healthy (to rule out a silent instrumentation gap rather than a genuine absence of events).
Generated by the Daily Security Observability workflow (consolidated from Daily Firewall Reporter + Daily DIFC Analyzer) Analysis window: Last 7 days | Repository: github/gh-aw Run: https://github.com/github/gh-aw/actions/runs/32869756199
reacted with thumbs up emoji reacted with thumbs down emoji reacted with laugh emoji reacted with hooray emoji reacted with confused emoji reacted with heart emoji reacted with rocket emoji reacted with eyes emoji
Uh oh!
There was an error while loading. Please reload this page.
Executive Summary
Over the last 7 days, 94 firewall-enabled workflow runs across the
github/gh-awrepository were analyzed, generating 4,343 monitored network requests with a healthy 2.0% block rate (87 blocked / 4,256 allowed). Blocking activity was heavily concentrated in a single event: Code Scanning Fixer (run32851862995) triggered 53 blocked requests across 51 distinct domains — largely legitimate Go/npm/OS package-manager and CRL/OCSP infrastructure hosts (proxy.golang.org,registry.npmjs.org,archive.ubuntu.com, various certificate-revocation endpoints) — suggesting the firewall policy for that workflow may be too restrictive for its build/toolchain needs rather than indicating malicious traffic. The only domain blocked repeatedly across multiple workflows wasregistry.npmjs.org:443(9 hits across CI Optimization Coach, Code Scanning Fixer, and Daily Go Test Parallelizer), a strong candidate for allowlisting if npm access is an expected dependency for these workflows.No DIFC (Data Integrity and Flow Control) integrity-filtered events were recorded in the same window — the gateway found zero qualifying runs, so there is nothing to report on that signal this cycle. This is a positive result: it indicates no tool calls were flagged for integrity or secrecy violations, but the "Firewall Analysis" section below remains the sole substantive intelligence signal for this report.
🔥 Firewall Analysis
Key Firewall Metrics
📈 Firewall Request Trends
Allowed request volume dominates the trend, consistent with normal MCP/API/telemetry traffic (
api.githubcopilot.com, Sentry, Grafana). Blocked traffic is a small, sporadic signal concentrated on a handful of dates tied to the Code Scanning Fixer and Daily Go Test Parallelizer runs rather than a sustained daily pattern — no evidence of an escalating or persistent attack/misconfiguration trend.Top Blocked Domains
registry.npmjs.org:443is the clear outlier with 9 blocks spread across three workflows, indicating a systemic policy gap rather than a one-off. The remaining ~55 domains each appear once, nearly all originating from a single Code Scanning Fixer run and covering legitimate Go toolchain, Ubuntu package/CRL, and certificate-authority infrastructure — these look like standard build-time dependency/CA-check traffic that the firewall policy doesn't yet recognize as safe.Most Frequently Blocked Domains
registry.npmjs.org:443*.grafana.net*.sentry.ioapi.github.comapi.githubcopilot.comapi.snapcraft.ioarchive.ubuntu.comawmg-cli-proxyawmg-mcpgazure.archive.ubuntu.comcrl.geotrust.comcrl.globalsign.comcrl.identrust.comcrl.sectigo.comcrl.thawte.comcrl.usertrust.comcrl.verisign.comcrl3.digicert.comcrl4.digicert.comcrls.ssl.comgo.dev/golang.org/goproxy.io/pkg.go.dev/proxy.golang.org/sum.golang.orgPolicy Rule Attribution
📋 Policy configurations observed this cycle (varying per-workflow rule counts):
11 rules, SSL Bump disabled, DLP disabled,10 rules, SSL Bump disabled, DLP disabled,12 rules, SSL Bump disabled, DLP disabled,9 rules, SSL Bump disabled, DLP disabled,8 rules, SSL Bump disabled, DLP disabled.No individual rule-hit or denied-request attribution data was available from the audited runs this cycle (rule-level hit counters were empty across all 99 analyzed audits), so a per-rule breakdown table cannot be produced this period.
View Detailed Request Patterns by Workflow
View Complete Blocked Domains List
*.grafana.net(1)*.sentry.io(1)api.github.com(1)api.githubcopilot.com(1)api.snapcraft.io(1)archive.ubuntu.com(1)awmg-cli-proxy(1)awmg-mcpg(1)azure.archive.ubuntu.com(1)crl.geotrust.com(1)crl.globalsign.com(1)crl.identrust.com(1)crl.sectigo.com(1)crl.thawte.com(1)crl.usertrust.com(1)crl.verisign.com(1)crl3.digicert.com(1)crl4.digicert.com(1)crls.ssl.com(1)github.com(1)github.github.io:443(1)go.dev(1)golang.org(1)goproxy.io(1)host.docker.internal(1)json-schema.org(1)json.schemastore.org(1)keyserver.ubuntu.com(1)ocsp.digicert.com(1)ocsp.geotrust.com(1)ocsp.globalsign.com(1)ocsp.identrust.com(1)ocsp.sectigo.com(1)ocsp.ssl.com(1)ocsp.thawte.com(1)ocsp.usertrust.com(1)ocsp.verisign.com(1)packagecloud.io(1)packages.cloud.google.com(1)packages.microsoft.com(1)pkg.go.dev(1)ppa.launchpad.net(1)proxy.golang.org(1)proxy.golang.org:443(1)raw.githubusercontent.com(1)registry.npmjs.org(1)registry.npmjs.org:443(9)s.symcb.com(1)s.symcd.com(1)security.ubuntu.com(1)storage.googleapis.com(1)storage.googleapis.com:443(1)sum.golang.org(1)ts-crl.ws.symantec.com(1)ts-ocsp.ws.symantec.com(1)www.googleapis.com(1)🔒 Firewall Security Recommendations
registry.npmjs.org:443for CI Optimization Coach, Code Scanning Fixer, and Daily Go Test Parallelizer if npm dependency access is an expected part of their tasks — it is the only domain blocked across multiple workflows and multiple runs.🔒 DIFC Integrity Analysis
No DIFC integrity-filtered events found in the last 7 days. The DIFC gateway log (
filtered-logs.json) returned zero runs, and the warm-start cache snapshot was empty and current (updated within the analysis window), confirming this is a true absence of filtered events rather than a stale or missing signal. No charts, per-workflow, per-server, or per-user breakdowns are available for this period.💡 DIFC Tuning Recommendations
Generated by the Daily Security Observability workflow (consolidated from Daily Firewall Reporter + Daily DIFC Analyzer)
Analysis window: Last 7 days | Repository: github/gh-aw
Run: https://github.com/github/gh-aw/actions/runs/32869756199
All reactions