From the course: GitHub Advanced Security Cert Prep by Microsoft Press

Unlock this course with a free trial

Join today to access over 24,700 courses taught by industry experts.

Contrast the steps for using CodeQL versus third-party analysis when enabling code scanning

Contrast the steps for using CodeQL versus third-party analysis when enabling code scanning - GitHub Tutorial

From the course: GitHub Advanced Security Cert Prep by Microsoft Press

Start my 1-month free trial Buy for my team

Contrast the steps for using CodeQL versus third-party analysis when enabling code scanning

“

- [Instructor] Okay, yes, this is a important question. Are you looking at either/or, both/and? This analysis may result in you are not purchasing GitHub Advanced Security right now, or it may solidify your decision to go with GHAS, and then layer in third-party tools on top, but let's look at some top line distinctions. CodeQL has a huge advantage because it's made by GitHub, and therefore, it's natively integrated with not only GitHub Actions, but the entire GitHub APIs. You have the QL language with built-in query packs, community-contributed query packs, and you can write your own queries for very specific code-scanning security analysis. The biggest hurdle to CodeQL, in my personal experience, is that the syntax and config is pretty dense. That's just my opinion. Third-party tools, you can take advantage of all of the premium value that a software-as-a-service vendor can give, particularly if it's a proprietary company. Predefined rule sets, but then again, you're limited to the…

Contents