@@ -37,7 +37,7 @@ There are a few ways to determine which product group works on which feature.
1. Search within the [Product Categories](/handbook/product/categories/) handbook page. On this page, you can do a Command ⌘ + F search for the feature in question. For example, if the question is on Review Apps, you can do a Command ⌘ + F search to see that the Review Apps feature is under the [Pipeline Security](/handbook/product/categories/#pipeline-security-group) group. If the question is related to our product roadmap, you can review the direction page associated with each product group.
1. Search within the documentation. Let's say you are wondering which product group could help with a question on [GitLab's Security Dashboard](https://docs.gitlab.com/ee/user/application_security/security_dashboard/). If you scroll to the bottom of the page and click `View page source`, you'll see which product Stage and Group the Security Dashboard rolls up to. In this case, it's the Threat Insights group.
1. Search within the documentation. Let's say you are wondering which product group could help with a question on [GitLab's Security Dashboard](https://docs.gitlab.com/ee/user/application_security/security_dashboard/). If you scroll to the bottom of the page and click `View page source`, you'll see which product Stage and Group the Security Dashboard rolls up to. In this case, it's the Security Insights group.
1. You can also determine the right product group by reviewing epics/issues related to the feature. For example, when researching [Customizable Roles and Permissions](https://gitlab.com/groups/gitlab-org/-/epics/4035), you see on the right-hand side under labels that Authentication and Authorization is the appropriate group.
@@ -25,6 +25,7 @@ The following teams comprise the sub-department:
- Security Policies group - [handbook](/handbook/engineering/development/sec/security-risk-management/security-policies/)
- Security Platform Management group
- Security Insights group - [handbook](/handbook/engineering/development/sec/security-risk-management/security-insights/)
- Security Infrastructure group - [handbook](/handbook/engineering/development/sec/security-risk-management/security-infrastructure/)
It is important to delineate who the EM and PM DRIs are for every functionality, especially where this may not be obvious. This is documented on a dedicated [delineation page](delineate-sec.html).
In the spirit of establishing a [DRI](/handbook/people-group/directly-responsible-individuals/) for each set of functionality where this may not be obvious, the purpose of this page is to explicitly define which engineering group has reponsibility for which portions of the product and for specific decisions.
@@ -58,8 +58,6 @@ Once the data is available as Report Artifact, it can be processed by the [GitLa
Depending on the context, the security reports can be stored in the database or stay as Report Artifacts for on-demand access.
This part is mainly covered by the [Threat Insights group](/handbook/product/categories/#threat-insights-group).
Though, the boundaries can sometimes be a bit blurry so [we're trying to delineate this as clearly as possible](/handbook/engineering/development/sec/delineate-sec/#technical-boundaries).
