Ignore Advanced Security Violations

Ignore rules allow you to whitelist and ignore security violation rules, to filter out unwanted violation noise. For example, you might be running Advanced Scans on a testing repository and don't want these violations to hinder your testing, or you might have instilled strict actions if a violation is found that is a blocker for continuing your development. You want to ignore the specific violation for the time being.

Ignore rules suppress specific violations so they aren't shown in future scans.
You can ignore by category, scanner, file path, or individual finding, and define the scope by artifact, build, Release Bundle, or watch.

There are many reasons why you might want to ignore a violation. For more information, see Ignore Rules.

You can create an ignore rule for Exposures violation using the following REST API:

• Create Ignore Rule

Ignore Secrets Violations

Secrets ignore rules can match an exposure, a file path, or an artifact.

You can ignore a Secrets violation by creating a Secrets Ignore Rule, which defines the exact conditions under which a secret should be suppressed in future scans. Use this when a secret is a false positive, non-actionable, or intentionally present in a specific location or artifact.

To ignore a Secrets violation:

1. Navigate to Scans List.

2. Open the Secrets Violation you want to ignore.

3. Click Ignore Violation to open the Secrets Ignore Rule window.

4. Select what to ignore under Ignore violation of:

   • Specific secret: Ignore this exact secret value. This includes secrets detected in binary files such as executables, JAR files, and Docker layers.
   • Specific scanner: Ignore all violations detected by a specific secret-detection rule.
   • All Secrets violations: Ignore all secret findings.

5. Define the Location scope:

   • In this specific file: Ignore the secret only when found in the selected file.
   • Matching this file path pattern: Ignore the secret when the file path matches an Ant-style pattern.
   • All files: Apply the ignore rule across any file.

6. If you select Matching this file path pattern, enter a valid Ant-style pattern in the field provided.

   • Supported syntax includes:
     • ** for recursive directory matching
     • * for wildcard matching within a file or directory name
   • Example patterns:
     • **/*.jar/**: Matches any path containing a .jar directory and everything inside it.
     • **/secret.txt: Matches any file named secret.txt at any level in the file tree.

7. Define the:

   • Artifact:
     • In this specific version
     • All versions of
     • All Artifacts: Ignore across all Artifacts.
   • Build
     • In this specific version
     • All versions of
     • All Builds
   • Release Bundle V2:
     • In this specific version
     • All versions of
     • All Release Bundle V2s

8. Define the Watch scope under Issued using Watches:

   • In selected Watches: Only suppress violations generated through specific Watches.
   • All Watches: Apply the rule regardless of which Watch triggered the violation.

   For more information, see Watches in JFrog Xray.

9. Add a Rule Description.

10. (Optional) Set an expiration date.

11. Click Create to save the ignore rule.

Related Topics

• Configure Advanced Security
• Create Custom Secrets Scanner
• Create Advanced Security Policies
• Advanced Security Reports