SOLVED

Defender for Devops showing deleted connection repositories

Copper Contributor

I removed a github connection in my defender for devops portal however the repositories are still in the portal both in the defender inventory and also when i create a new connection to a different github org. There doesnt seem to be any way to delete these github repos from the defender for devops portal. Does anyone have any idea how this can be done? I've gone as far as to turn off defender for cloud on my subscription but this doesn't seem to work as the inventory still shows these old github repositories and alerts.

6 Replies
its requires 24 hours to disappear from the inventory blade in MDC.

Hi @eliekarkafy 

 

it’s been over 24 hours now and the devices are still reporting in the inventory list. Also if I create a new connection in defender for cloud to a separate GitHub repository all these old repositories appear in the list even tho they no longer exist. Is there any way these can be removed from defender logs?

once you delete the connection the github resources should disappear from the inventory blade. Give it couple of days and if the issue persists, open a ticket with the security team to check your tenant in the backend because this feature is still under preview

I've left it over the weekend and still the same @eliekarkafy I'm running a vs studio enterprise sub so dont have access to technical support. Is there anyway to report this via another channel as a bug or something?

did the exercise triggered an alert in MDE ?
best response confirmed by craggab (Copper Contributor)
Solution

Ok so I've made some progress here :smile: @eliekarkafy 

 

Its been about a week since I removed my existing Github connector in Defender for devops and all the old repositories were still showing in the inventory blade.

 

I decided to create a new connector with new naming conventions for the connector and resource group as well as new org in github with no pre-existing authorisation from Defender for cloud. This seems to have initiated a clean up of the existing repos in the Defender for

Devops blade as now I am seeing the new repositories and the old ones have dissapeared.

 

The old repos are still reporting however in the inventory blade and i guess this will remain in the defender logs for a period of time untill the data is eventually archived or purged (I'm guessing). 

 

Also in Defender for devops under 'defender coverage' shows as having 11 (old) repos when reality is i have only 3 but im also assuming that this will be updated once the initial synchronisation process completes in the console.

 

Always fun testing out new products in public preview, thanks for your help @eliekarkafy