GitHub Enterprise (On-Prem)

Integrate Cortex Cloud Application Security with your GitHub Enterprise (On-Prem) version control system (VCS) to enable security scans for exposed secrets, infrastructure-as-code (IaC) misconfigurations, vulnerabilities, package operational risks, and license compliance issues in your repositories. This integration allows you to analyze, prioritize, and resolve detected issues efficiently.

Architecture and connectivity

Whether you need a Transporter depends on your GitHub Enterprise on-prem accessibility. If your instance is hosted on a private domain, a direct connection fails because Cortex Cloud cannot reach the on-premises host.

To solve this, the Transporter over Broker VM bridges the connection by:

• Living inside your network as an applet on the Broker VM
• Initiating an outbound WebSocket connection to the cloud, meaning no inbound firewall rules or direct IP access are needed
• Proxying requests from the cloud to internal resources, allowing Cortex Cloud to perform secure code scanning without exposing your internal network to the public cloud

Connection guidelines

• Private domains (isolated environments): Always use a Transporter. Make sure the Transporter has an AppSec applet enabled so it appears in the onboarding wizard. An egress rule is not required
• Public domains (internet-accessible): If your GitHub Enterprise on-prem instance is already internet-accessible or managed via existing connectivity solutions (such as a VPN or network peering), a Transporter is not needed. An egress rule is required

For more information, see Transporter over Broker VM.

Learn more

• Onboard GitHub Enterprise (On-Prem)
• Reference A: GitHub Enterprise OAuth scopes
• Reference B: Egress proxy IP addresses
• Reference C: GitHub Enterprise subscribed events