[{"data":1,"prerenderedAt":2064},["ShallowReactive",2],{"/ja-jp/blog/severity-override-vulnerability-management-policy":3,"navigation-ja-jp":1281,"banner-ja-jp":1711,"footer-ja-jp":1719,"blog-post-authors-ja-jp-Grant Hickman":1961,"blog-related-posts-ja-jp-severity-override-vulnerability-management-policy":1976,"blog-promotions-ja-jp":2002,"next-steps-ja-jp":2055},{"id":4,"title":5,"authors":6,"body":8,"category":1261,"date":1262,"description":1263,"extension":1264,"externalUrl":1265,"faq":1265,"featured":1266,"heroImage":1267,"meta":1268,"navigation":1269,"path":1270,"seo":1271,"slug":1274,"stem":1275,"tags":1276,"template":1278,"updatedDate":1279,"__hash__":1280},"blogPosts/ja-jp/blog/severity-override-vulnerability-management-policy.md","誤解を招く脆弱性の重大度を、ポリシーで修正する5つの方法",[7],"Grant Hickman",{"type":9,"value":10,"toc":1247},"minimark",[11,15,18,22,32,35,58,61,64,67,72,75,78,273,280,284,303,306,461,470,474,477,480,619,622,626,635,638,776,779,783,790,793,966,969,972,975,1012,1015,1177,1180,1189,1201,1209,1217,1225,1243],[12,13,14],"p",{},"企業の脆弱性レポートには、スキャンサイクルごとに数百件もの検出結果が表示され、すべてCVSS（共通脆弱性評価システム）によってランク付けされています。問題は、CVSSがCVE（共通脆弱性識別子）の理論的な特性を記述するものであり、自社環境での実際のリスクを示すものではないという点です。内部専用のユーティリティライブラリにある「緊急（Critical）」の脆弱性と、公開されている認証サービスにある「中（Medium）」の脆弱性は、リスクとして同列には扱えません。しかし、手動でトリアージしない限り、両者は同じように扱われてしまいます。こうした手動トリアージは、スケールしません。",[12,16,17],{},"GitLabの脆弱性管理ポリシーでは、定義した条件に基づいてデフォルトのCVSS重大度レベルを自動的にオーバーライドできるようになりました。これにより、脆弱性レポートが汎用的なスコアではなく、自社の実際のリスクモデルを反映したものになります。",[19,20,21],"h2",{"id":21},"重大度オーバーライドポリシーの仕組み",[12,23,24,25,31],{},"重大度オーバーライドポリシーは、",[26,27,30],"a",{"href":28,"rel":29},"https://docs.gitlab.com/ja-jp/user/application_security/policies/vulnerability_management_policy/",[],"脆弱性管理ポリシー","の一種で、デフォルトブランチのパイプライン実行のたびに脆弱性の重大度レベルを自動的に調整します。マッチ条件（CVE ID、CWE ID、ファイルパス、ディレクトリ）とオーバーライドアクションを含むルールを定義します。脆弱性が条件に一致すると、GitLabのSecurity Policy Botが即座に重大度を更新します。",[12,33,34],{},"利用できるオーバーライド操作は3種類です。",[36,37,38,46,52],"ul",{},[39,40,41,45],"li",{},[42,43,44],"strong",{},"重大度を設定（Set Severity）",": 重大度を特定のレベル（info、low、medium、high、critical）に固定します。",[39,47,48,51],{},[42,49,50],{},"重大度を上げる（Increase Severity）",": 重大度を1段階引き上げます。",[39,53,54,57],{},[42,55,56],{},"重大度を下げる（Decrease Severity）",": 重大度を1段階引き下げます。",[12,59,60],{},"権限を持つユーザーによる手動オーバーライドは、常にポリシーによるオーバーライドより優先されます。自動変更はすべて脆弱性の履歴と監査イベントに記録されるため、何が変更され、その理由についての完全な記録を維持できます。",[19,62,63],{"id":63},"すぐに使える設定付きユースケース",[12,65,66],{},"以下の各例には、すぐにコピー・カスタマイズして適用できるポリシー設定を記載しています。",[68,69,71],"h3",{"id":70},"_1-内部サービスにおける低リスクcveの重大度を下げる","1. 内部サービスにおける低リスクCVEの重大度を下げる",[12,73,74],{},"セキュリティスキャナーは、どのプロジェクトが内部ツール、テストユーティリティ、または本番サービスであるかを認識しません。デプロイのコンテキストに関わらず、すべてのCVEを同じように評価します。外部トラフィックにさらされることのない内部管理ダッシュボード、開発者向けツール、バッチ処理ジョブを運用しているチームにとって、Critical評価の依存関係の脆弱性は、顧客向けAPIにある脆弱性と同じ対応を必要とするわけではありません。",[12,76,77],{},"このポリシーは、内部サービスのディレクトリで検出された特定のCVEの重大度を下げます。",[79,80,85],"pre",{"className":81,"code":82,"language":83,"meta":84,"style":84},"language-yaml shiki shiki-themes github-light","vulnerability_management_policy:\n  - name: \"Downgrade CVEs in internal services\"\n    description: \"Internal-only services have lower exposure risk\"\n    enabled: true\n    rules:\n      - type: detected\n        criteria:\n          - type: identifier\n            identifier_type: cve\n            values:\n              - \"CVE-2023-44487\"\n              - \"CVE-2024-29041\"\n          - type: directory\n            value: \"internal/**/*\"\n    actions:\n      - type: severity_override\n        severity_override_operation: decrease\n","yaml","",[86,87,88,101,117,128,140,148,162,170,183,194,202,211,219,231,242,250,262],"code",{"__ignoreMap":84},[89,90,93,97],"span",{"class":91,"line":92},"line",1,[89,94,96],{"class":95},"shJU0","vulnerability_management_policy",[89,98,100],{"class":99},"sgsFI",":\n",[89,102,104,107,110,113],{"class":91,"line":103},2,[89,105,106],{"class":99},"  - ",[89,108,109],{"class":95},"name",[89,111,112],{"class":99},": ",[89,114,116],{"class":115},"sYBdl","\"Downgrade CVEs in internal services\"\n",[89,118,120,123,125],{"class":91,"line":119},3,[89,121,122],{"class":95},"    description",[89,124,112],{"class":99},[89,126,127],{"class":115},"\"Internal-only services have lower exposure risk\"\n",[89,129,131,134,136],{"class":91,"line":130},4,[89,132,133],{"class":95},"    enabled",[89,135,112],{"class":99},[89,137,139],{"class":138},"sYu0t","true\n",[89,141,143,146],{"class":91,"line":142},5,[89,144,145],{"class":95},"    rules",[89,147,100],{"class":99},[89,149,151,154,157,159],{"class":91,"line":150},6,[89,152,153],{"class":99},"      - ",[89,155,156],{"class":95},"type",[89,158,112],{"class":99},[89,160,161],{"class":115},"detected\n",[89,163,165,168],{"class":91,"line":164},7,[89,166,167],{"class":95},"        criteria",[89,169,100],{"class":99},[89,171,173,176,178,180],{"class":91,"line":172},8,[89,174,175],{"class":99},"          - ",[89,177,156],{"class":95},[89,179,112],{"class":99},[89,181,182],{"class":115},"identifier\n",[89,184,186,189,191],{"class":91,"line":185},9,[89,187,188],{"class":95},"            identifier_type",[89,190,112],{"class":99},[89,192,193],{"class":115},"cve\n",[89,195,197,200],{"class":91,"line":196},10,[89,198,199],{"class":95},"            values",[89,201,100],{"class":99},[89,203,205,208],{"class":91,"line":204},11,[89,206,207],{"class":99},"              - ",[89,209,210],{"class":115},"\"CVE-2023-44487\"\n",[89,212,214,216],{"class":91,"line":213},12,[89,215,207],{"class":99},[89,217,218],{"class":115},"\"CVE-2024-29041\"\n",[89,220,222,224,226,228],{"class":91,"line":221},13,[89,223,175],{"class":99},[89,225,156],{"class":95},[89,227,112],{"class":99},[89,229,230],{"class":115},"directory\n",[89,232,234,237,239],{"class":91,"line":233},14,[89,235,236],{"class":95},"            value",[89,238,112],{"class":99},[89,240,241],{"class":115},"\"internal/**/*\"\n",[89,243,245,248],{"class":91,"line":244},15,[89,246,247],{"class":95},"    actions",[89,249,100],{"class":99},[89,251,253,255,257,259],{"class":91,"line":252},16,[89,254,153],{"class":99},[89,256,156],{"class":95},[89,258,112],{"class":99},[89,260,261],{"class":115},"severity_override\n",[89,263,265,268,270],{"class":91,"line":264},17,[89,266,267],{"class":95},"        severity_override_operation",[89,269,112],{"class":99},[89,271,272],{"class":115},"decrease\n",[12,274,275,276,279],{},"CVEの値は、チームが内部デプロイにおいて低リスクと判断した識別子に置き換えてください。",[86,277,278],{},"decrease"," 操作により重大度が1段階下がります（CriticalはHighに、HighはMediumになります）。コンテキストに不適切なスコアに過剰反応することなく、相対的な優先度を維持できます。",[68,281,283],{"id":282},"_2-本番コードにおけるインジェクション脆弱性の重大度を上げる","2. 本番コードにおけるインジェクション脆弱性の重大度を上げる",[12,285,286,287,292,293,298,299,302],{},"本番ソースコードで検出された場合、より強力な対応が必要な脆弱性クラスがあります。クロスサイトスクリプティング（CWE-79）およびSQLインジェクション（CWE-89）は、",[26,288,291],{"href":289,"rel":290},"https://about.gitlab.com/blog/2025-owasp-top-10-whats-changed-and-why-it-matters/",[],"OWASP","とCISAの",[26,294,297],{"href":295,"rel":296},"https://www.cisa.gov/known-exploited-vulnerabilities-catalog",[],"既知の悪用された脆弱性（KEV）","カタログによると、最も悪用されている脆弱性タイプに継続的にランクインしています。スキャナーが ",[86,300,301],{},"src/"," ディレクトリ内でこれらをMediumまたはHighと報告している場合、トリアージプロセスではCriticalとして扱う必要があります。",[12,304,305],{},"このポリシーは、本番コードにおけるXSSおよびSQLiの検出結果の重大度をCriticalに設定します。",[79,307,309],{"className":81,"code":308,"language":83,"meta":84,"style":84},"vulnerability_management_policy:\n  - name: \"Upgrade XSS and SQLi in production code\"\n    description: \"Injection vulnerabilities in src/ are always Critical\"\n    enabled: true\n    rules:\n      - type: detected\n        criteria:\n          - type: identifier\n            identifier_type: cwe\n            values:\n              - \"CWE-79\"\n              - \"CWE-89\"\n          - type: directory\n            value: \"src/**/*\"\n    actions:\n      - type: severity_override\n        severity_override_operation: set\n        severity_override_value: critical\n",[86,310,311,317,328,337,345,351,361,367,377,386,392,399,406,416,425,431,441,450],{"__ignoreMap":84},[89,312,313,315],{"class":91,"line":92},[89,314,96],{"class":95},[89,316,100],{"class":99},[89,318,319,321,323,325],{"class":91,"line":103},[89,320,106],{"class":99},[89,322,109],{"class":95},[89,324,112],{"class":99},[89,326,327],{"class":115},"\"Upgrade XSS and SQLi in production code\"\n",[89,329,330,332,334],{"class":91,"line":119},[89,331,122],{"class":95},[89,333,112],{"class":99},[89,335,336],{"class":115},"\"Injection vulnerabilities in src/ are always Critical\"\n",[89,338,339,341,343],{"class":91,"line":130},[89,340,133],{"class":95},[89,342,112],{"class":99},[89,344,139],{"class":138},[89,346,347,349],{"class":91,"line":142},[89,348,145],{"class":95},[89,350,100],{"class":99},[89,352,353,355,357,359],{"class":91,"line":150},[89,354,153],{"class":99},[89,356,156],{"class":95},[89,358,112],{"class":99},[89,360,161],{"class":115},[89,362,363,365],{"class":91,"line":164},[89,364,167],{"class":95},[89,366,100],{"class":99},[89,368,369,371,373,375],{"class":91,"line":172},[89,370,175],{"class":99},[89,372,156],{"class":95},[89,374,112],{"class":99},[89,376,182],{"class":115},[89,378,379,381,383],{"class":91,"line":185},[89,380,188],{"class":95},[89,382,112],{"class":99},[89,384,385],{"class":115},"cwe\n",[89,387,388,390],{"class":91,"line":196},[89,389,199],{"class":95},[89,391,100],{"class":99},[89,393,394,396],{"class":91,"line":204},[89,395,207],{"class":99},[89,397,398],{"class":115},"\"CWE-79\"\n",[89,400,401,403],{"class":91,"line":213},[89,402,207],{"class":99},[89,404,405],{"class":115},"\"CWE-89\"\n",[89,407,408,410,412,414],{"class":91,"line":221},[89,409,175],{"class":99},[89,411,156],{"class":95},[89,413,112],{"class":99},[89,415,230],{"class":115},[89,417,418,420,422],{"class":91,"line":233},[89,419,236],{"class":95},[89,421,112],{"class":99},[89,423,424],{"class":115},"\"src/**/*\"\n",[89,426,427,429],{"class":91,"line":244},[89,428,247],{"class":95},[89,430,100],{"class":99},[89,432,433,435,437,439],{"class":91,"line":252},[89,434,153],{"class":99},[89,436,156],{"class":95},[89,438,112],{"class":99},[89,440,261],{"class":115},[89,442,443,445,447],{"class":91,"line":264},[89,444,267],{"class":95},[89,446,112],{"class":99},[89,448,449],{"class":115},"set\n",[89,451,453,456,458],{"class":91,"line":452},18,[89,454,455],{"class":95},"        severity_override_value",[89,457,112],{"class":99},[89,459,460],{"class":115},"critical\n",[12,462,463,464,469],{},"このポリシーと、Criticalの検出結果にセキュリティチームの承認を必要とする",[26,465,468],{"href":466,"rel":467},"https://docs.gitlab.com/ja-jp/user/application_security/policies/merge_request_approval_policies/",[],"マージリクエスト承認ポリシー","を組み合わせることをお勧めします。重大度オーバーライドにより、脆弱性レポートで適切な検出結果にフラグが立てられて優先度が付けられ、承認ポリシーにより、新たに検出された検出結果がレビューなしに本番環境に到達できなくなります。",[68,471,473],{"id":472},"_3-スキャナー間で重大度を統一する","3. スキャナー間で重大度を統一する",[12,475,476],{},"スキャナーによっては、同じCVEに異なる重大度レベルを割り当てることがあります。SAST（静的アプリケーションセキュリティテスト）スキャナーがHighと評価した検出結果を、依存関係スキャンがMediumと呼ぶ場合があります。こうした不整合はトリアージ時に混乱を招き、スキャンタイプをまたいだ一貫した承認しきい値の設定を困難にします。",[12,478,479],{},"重大度オーバーライドポリシーを使用して、一貫したベースラインを適用します。セキュリティチームが特定のCVEファミリーを評価し、どのスキャナーで検出されたかに関わらず常にHighであるべきと判断した場合、明示的に設定できます。",[79,481,483],{"className":81,"code":482,"language":83,"meta":84,"style":84},"vulnerability_management_policy:\n  - name: \"Normalize log4j severity to High\"\n    description: \"Consistent severity for log4j CVEs across all scanners\"\n    enabled: true\n    rules:\n      - type: detected\n        criteria:\n          - type: identifier\n            identifier_type: cve\n            values:\n              - \"CVE-2021-44228\"\n              - \"CVE-2021-45046\"\n              - \"CVE-2021-45105\"\n    actions:\n      - type: severity_override\n        severity_override_operation: set\n        severity_override_value: high\n",[86,484,485,491,502,511,519,525,535,541,551,559,565,572,579,586,592,602,610],{"__ignoreMap":84},[89,486,487,489],{"class":91,"line":92},[89,488,96],{"class":95},[89,490,100],{"class":99},[89,492,493,495,497,499],{"class":91,"line":103},[89,494,106],{"class":99},[89,496,109],{"class":95},[89,498,112],{"class":99},[89,500,501],{"class":115},"\"Normalize log4j severity to High\"\n",[89,503,504,506,508],{"class":91,"line":119},[89,505,122],{"class":95},[89,507,112],{"class":99},[89,509,510],{"class":115},"\"Consistent severity for log4j CVEs across all scanners\"\n",[89,512,513,515,517],{"class":91,"line":130},[89,514,133],{"class":95},[89,516,112],{"class":99},[89,518,139],{"class":138},[89,520,521,523],{"class":91,"line":142},[89,522,145],{"class":95},[89,524,100],{"class":99},[89,526,527,529,531,533],{"class":91,"line":150},[89,528,153],{"class":99},[89,530,156],{"class":95},[89,532,112],{"class":99},[89,534,161],{"class":115},[89,536,537,539],{"class":91,"line":164},[89,538,167],{"class":95},[89,540,100],{"class":99},[89,542,543,545,547,549],{"class":91,"line":172},[89,544,175],{"class":99},[89,546,156],{"class":95},[89,548,112],{"class":99},[89,550,182],{"class":115},[89,552,553,555,557],{"class":91,"line":185},[89,554,188],{"class":95},[89,556,112],{"class":99},[89,558,193],{"class":115},[89,560,561,563],{"class":91,"line":196},[89,562,199],{"class":95},[89,564,100],{"class":99},[89,566,567,569],{"class":91,"line":204},[89,568,207],{"class":99},[89,570,571],{"class":115},"\"CVE-2021-44228\"\n",[89,573,574,576],{"class":91,"line":213},[89,575,207],{"class":99},[89,577,578],{"class":115},"\"CVE-2021-45046\"\n",[89,580,581,583],{"class":91,"line":221},[89,582,207],{"class":99},[89,584,585],{"class":115},"\"CVE-2021-45105\"\n",[89,587,588,590],{"class":91,"line":233},[89,589,247],{"class":95},[89,591,100],{"class":99},[89,593,594,596,598,600],{"class":91,"line":244},[89,595,153],{"class":99},[89,597,156],{"class":95},[89,599,112],{"class":99},[89,601,261],{"class":115},[89,603,604,606,608],{"class":91,"line":252},[89,605,267],{"class":95},[89,607,112],{"class":99},[89,609,449],{"class":115},[89,611,612,614,616],{"class":91,"line":264},[89,613,455],{"class":95},[89,615,112],{"class":99},[89,617,618],{"class":115},"high\n",[12,620,621],{},"これは、SAST、依存関係スキャン、コンテナスキャンなど複数のスキャンタイプを運用している組織において特に有効です。検出方法によって評価が異なる同一の脆弱性が、それぞれ異なる重大度で表示される状況に対処できます。",[68,623,625],{"id":624},"_4-エクスプロイトインテリジェンスに合わせて重大度を調整する","4. エクスプロイトインテリジェンスに合わせて重大度を調整する",[12,627,628,629,634],{},"CVSSスコアは静的です。脆弱性が実際に悪用されはじめても変化せず、現実世界での悪用確率も考慮しません。FIRSTの",[26,630,633],{"href":631,"rel":632},"https://www.first.org/epss/",[],"Exploit Prediction Scoring System（EPSS）","とCISAのKEVカタログが、この欠けているシグナルを提供します。",[12,636,637],{},"脅威インテリジェンスから、あるMedium重大度のCVEが現在活発に悪用されている（KEV）か、悪用確率が高い（EPSSが0.5超）と判明した場合、重大度オーバーライドで引き上げます。",[79,639,641],{"className":81,"code":640,"language":83,"meta":84,"style":84},"vulnerability_management_policy:\n  - name: \"Upgrade actively exploited CVEs\"\n    description: \"CVEs in CISA KEV catalog should be treated as Critical\"\n    enabled: true\n    rules:\n      - type: detected\n        criteria:\n          - type: identifier\n            identifier_type: cve\n            values:\n              - \"CVE-2024-3094\"\n              - \"CVE-2023-4966\"\n              - \"CVE-2023-22515\"\n    actions:\n      - type: severity_override\n        severity_override_operation: set\n        severity_override_value: critical\n",[86,642,643,649,660,669,677,683,693,699,709,717,723,730,737,744,750,760,768],{"__ignoreMap":84},[89,644,645,647],{"class":91,"line":92},[89,646,96],{"class":95},[89,648,100],{"class":99},[89,650,651,653,655,657],{"class":91,"line":103},[89,652,106],{"class":99},[89,654,109],{"class":95},[89,656,112],{"class":99},[89,658,659],{"class":115},"\"Upgrade actively exploited CVEs\"\n",[89,661,662,664,666],{"class":91,"line":119},[89,663,122],{"class":95},[89,665,112],{"class":99},[89,667,668],{"class":115},"\"CVEs in CISA KEV catalog should be treated as Critical\"\n",[89,670,671,673,675],{"class":91,"line":130},[89,672,133],{"class":95},[89,674,112],{"class":99},[89,676,139],{"class":138},[89,678,679,681],{"class":91,"line":142},[89,680,145],{"class":95},[89,682,100],{"class":99},[89,684,685,687,689,691],{"class":91,"line":150},[89,686,153],{"class":99},[89,688,156],{"class":95},[89,690,112],{"class":99},[89,692,161],{"class":115},[89,694,695,697],{"class":91,"line":164},[89,696,167],{"class":95},[89,698,100],{"class":99},[89,700,701,703,705,707],{"class":91,"line":172},[89,702,175],{"class":99},[89,704,156],{"class":95},[89,706,112],{"class":99},[89,708,182],{"class":115},[89,710,711,713,715],{"class":91,"line":185},[89,712,188],{"class":95},[89,714,112],{"class":99},[89,716,193],{"class":115},[89,718,719,721],{"class":91,"line":196},[89,720,199],{"class":95},[89,722,100],{"class":99},[89,724,725,727],{"class":91,"line":204},[89,726,207],{"class":99},[89,728,729],{"class":115},"\"CVE-2024-3094\"\n",[89,731,732,734],{"class":91,"line":213},[89,733,207],{"class":99},[89,735,736],{"class":115},"\"CVE-2023-4966\"\n",[89,738,739,741],{"class":91,"line":221},[89,740,207],{"class":99},[89,742,743],{"class":115},"\"CVE-2023-22515\"\n",[89,745,746,748],{"class":91,"line":233},[89,747,247],{"class":95},[89,749,100],{"class":99},[89,751,752,754,756,758],{"class":91,"line":244},[89,753,153],{"class":99},[89,755,156],{"class":95},[89,757,112],{"class":99},[89,759,261],{"class":115},[89,761,762,764,766],{"class":91,"line":252},[89,763,267],{"class":95},[89,765,112],{"class":99},[89,767,449],{"class":115},[89,769,770,772,774],{"class":91,"line":264},[89,771,455],{"class":95},[89,773,112],{"class":99},[89,775,460],{"class":115},[12,777,778],{},"自社のスタックに関連するKEVエントリのリストを管理し、新たなCVEがカタログに追加されるたびにポリシーを更新してください。これにより、アナリストが各検出結果を手動で調整することなく、脅威インテリジェンスと開発者向けの重大度表示をつなぐフィードバックループが生まれます。",[68,780,782],{"id":781},"_5-グループレベルで組織全体のリスクモデルを適用する","5. グループレベルで組織全体のリスクモデルを適用する",[12,784,785,786,789],{},"組織に数百または数千のプロジェクトがある場合、プロジェクト単位のポリシーは管理できません。重大度オーバーライドポリシーはグループレベルで適用でき、グループ内のすべてのプロジェクトに影響を与えます。",[86,787,788],{},"policy_scope"," と組み合わせることで、特定のコンプライアンスフレームワークラベルに一致するプロジェクトにポリシーをターゲット指定できます。",[12,791,792],{},"例えば、「PCI-DSS」コンプライアンスフレームワークを持つ組織では、PCI対象プロジェクト全体にインジェクション脆弱性の厳格な重大度処理を適用しつつ、内部ツールグループには緩いポリシーを適用できます。",[79,794,796],{"className":81,"code":795,"language":83,"meta":84,"style":84},"vulnerability_management_policy:\n  - name: \"PCI projects: upgrade injection severity\"\n    description: \"All injection vulnerabilities are Critical in PCI scope\"\n    enabled: true\n    policy_scope:\n      compliance_frameworks:\n        - id: 12345\n    rules:\n      - type: detected\n        criteria:\n          - type: identifier\n            identifier_type: cwe\n            values:\n              - \"CWE-79\"\n              - \"CWE-89\"\n              - \"CWE-78\"\n              - \"CWE-94\"\n    actions:\n      - type: severity_override\n        severity_override_operation: set\n        severity_override_value: critical\n",[86,797,798,804,815,824,832,839,846,859,865,875,881,891,899,905,911,917,924,931,937,948,957],{"__ignoreMap":84},[89,799,800,802],{"class":91,"line":92},[89,801,96],{"class":95},[89,803,100],{"class":99},[89,805,806,808,810,812],{"class":91,"line":103},[89,807,106],{"class":99},[89,809,109],{"class":95},[89,811,112],{"class":99},[89,813,814],{"class":115},"\"PCI projects: upgrade injection severity\"\n",[89,816,817,819,821],{"class":91,"line":119},[89,818,122],{"class":95},[89,820,112],{"class":99},[89,822,823],{"class":115},"\"All injection vulnerabilities are Critical in PCI scope\"\n",[89,825,826,828,830],{"class":91,"line":130},[89,827,133],{"class":95},[89,829,112],{"class":99},[89,831,139],{"class":138},[89,833,834,837],{"class":91,"line":142},[89,835,836],{"class":95},"    policy_scope",[89,838,100],{"class":99},[89,840,841,844],{"class":91,"line":150},[89,842,843],{"class":95},"      compliance_frameworks",[89,845,100],{"class":99},[89,847,848,851,854,856],{"class":91,"line":164},[89,849,850],{"class":99},"        - ",[89,852,853],{"class":95},"id",[89,855,112],{"class":99},[89,857,858],{"class":138},"12345\n",[89,860,861,863],{"class":91,"line":172},[89,862,145],{"class":95},[89,864,100],{"class":99},[89,866,867,869,871,873],{"class":91,"line":185},[89,868,153],{"class":99},[89,870,156],{"class":95},[89,872,112],{"class":99},[89,874,161],{"class":115},[89,876,877,879],{"class":91,"line":196},[89,878,167],{"class":95},[89,880,100],{"class":99},[89,882,883,885,887,889],{"class":91,"line":204},[89,884,175],{"class":99},[89,886,156],{"class":95},[89,888,112],{"class":99},[89,890,182],{"class":115},[89,892,893,895,897],{"class":91,"line":213},[89,894,188],{"class":95},[89,896,112],{"class":99},[89,898,385],{"class":115},[89,900,901,903],{"class":91,"line":221},[89,902,199],{"class":95},[89,904,100],{"class":99},[89,906,907,909],{"class":91,"line":233},[89,908,207],{"class":99},[89,910,398],{"class":115},[89,912,913,915],{"class":91,"line":244},[89,914,207],{"class":99},[89,916,405],{"class":115},[89,918,919,921],{"class":91,"line":252},[89,920,207],{"class":99},[89,922,923],{"class":115},"\"CWE-78\"\n",[89,925,926,928],{"class":91,"line":264},[89,927,207],{"class":99},[89,929,930],{"class":115},"\"CWE-94\"\n",[89,932,933,935],{"class":91,"line":452},[89,934,247],{"class":95},[89,936,100],{"class":99},[89,938,940,942,944,946],{"class":91,"line":939},19,[89,941,153],{"class":99},[89,943,156],{"class":95},[89,945,112],{"class":99},[89,947,261],{"class":115},[89,949,951,953,955],{"class":91,"line":950},20,[89,952,267],{"class":95},[89,954,112],{"class":99},[89,956,449],{"class":115},[89,958,960,962,964],{"class":91,"line":959},21,[89,961,455],{"class":95},[89,963,112],{"class":99},[89,965,460],{"class":115},[12,967,968],{},"このパターンにより、セキュリティチームがリスクモデルを一度定義するだけで、あらゆる場所に一貫して適用されます。プロジェクトごとの設定も、個々のチームが正しく設定することへの依存も不要です。",[19,970,971],{"id":971},"はじめ方",[12,973,974],{},"脆弱性管理ポリシーを作成するには、以下の手順に従ってください。",[976,977,978,984,990,996,1006],"ol",{},[39,979,980,983],{},[42,981,982],{},"不一致を特定する。"," 脆弱性レポートを開き、「Needs triage」でフィルタリングします。パターンを探してください。テストコードにあるCriticalの検出結果、活発に悪用されているMediumの検出結果、スキャンタイプをまたいだ一貫性のない評価などです。",[39,985,986,989],{},[42,987,988],{},"ユースケースを1つ選ぶ。"," 上記のシナリオの中から、最も多くの不一致な検出結果に対応するものから始めます。",[39,991,992,995],{},[42,993,994],{},"ベースラインを記録する。"," ポリシーを作成する前の重大度分布（対象スコープ内のCritical、High、Mediumの件数）を記録します。",[39,997,998,1001,1002,1005],{},[42,999,1000],{},"作成して適用する。"," ",[42,1003,1004],{},"Secure > Policies > New policy > Vulnerability management policy"," に移動し、上記のユースケースから設定を貼り付けてマージリクエストをマージします。",[39,1007,1008,1011],{},[42,1009,1010],{},"結果を検証する。"," 次のデフォルトブランチパイプライン実行後、脆弱性レポートで更新された重大度を確認します。アクティビティログをフィルタリングして調整された検出結果を確認し、対象が正しいことを検証します。",[68,1013,1014],{"id":1014},"クイックリファレンス",[1016,1017,1018,1031],"table",{},[1019,1020,1021],"thead",{},[1022,1023,1024,1028],"tr",{},[1025,1026,1027],"th",{},"パラメータ",[1025,1029,1030],{},"詳細",[1032,1033,1034,1069,1089,1113,1134,1144,1154,1167],"tbody",{},[1022,1035,1036,1042],{},[1037,1038,1039],"td",{},[42,1040,1041],{},"条件タイプ",[1037,1043,1044,1047,1048,1047,1051,1054,1055,1058,1059,1047,1062,1047,1065,1068],{},[86,1045,1046],{},"file_path","、",[86,1049,1050],{},"directory",[86,1052,1053],{},"identifier","（オプションの ",[86,1056,1057],{},"identifier_type","：",[86,1060,1061],{},"cve",[86,1063,1064],{},"cwe",[86,1066,1067],{},"owasp","）",[1022,1070,1071,1076],{},[1037,1072,1073],{},[42,1074,1075],{},"オーバーライド操作",[1037,1077,1078,1081,1082,1085,1086,1088],{},[86,1079,1080],{},"set","（特定レベルに設定）、",[86,1083,1084],{},"increase","（1段階上げ）、",[86,1087,278],{},"（1段階下げ）",[1022,1090,1091,1096],{},[1037,1092,1093],{},[42,1094,1095],{},"重大度レベル",[1037,1097,1098,1047,1101,1047,1104,1047,1107,1047,1110],{},[86,1099,1100],{},"info",[86,1102,1103],{},"low",[86,1105,1106],{},"medium",[86,1108,1109],{},"high",[86,1111,1112],{},"critical",[1022,1114,1115,1120],{},[1037,1116,1117],{},[42,1118,1119],{},"値",[1037,1121,1122,1123,1126,1127,1130,1131,1068],{},"単一の ",[86,1124,1125],{},"value"," または ",[86,1128,1129],{},"values"," 配列（最大1,000件、OR論理）。ワイルドカード対応（例：",[86,1132,1133],{},"CVE-2023-*",[1022,1135,1136,1141],{},[1037,1137,1138],{},[42,1139,1140],{},"条件の論理",[1037,1142,1143],{},"1つのルール内の複数条件 = AND（すべてに一致）。1つのポリシー内の複数ルール = OR（いずれかに一致）",[1022,1145,1146,1151],{},[1037,1147,1148],{},[42,1149,1150],{},"制限",[1037,1152,1153],{},"ルールごとに条件3件、ポリシーごとにルール5件、セキュリティポリシープロジェクトごとにポリシー5件",[1022,1155,1156,1161],{},[1037,1157,1158],{},[42,1159,1160],{},"スコープ",[1037,1162,1163,1164,1166],{},"プロジェクトレベルまたはグループレベル。コンプライアンスフレームワークのターゲット指定には ",[86,1165,788],{}," を使用",[1022,1168,1169,1174],{},[1037,1170,1171],{},[42,1172,1173],{},"手動オーバーライドの優先度",[1037,1175,1176],{},"権限を持つユーザーによる手動オーバーライドは常に優先されます",[19,1178,1179],{"id":1179},"よくある質問",[12,1181,1182,1185,1188],{},[42,1183,1184],{},"自動却下（auto-dismiss）と重大度オーバーライドの違いは何ですか？",[1186,1187],"br",{},"\n自動却下は、検出結果をアクティブなトリアージキューから削除します。重大度オーバーライドは、検出結果を表示したまま優先度レベルを調整するため、適切な緊急度で追跡・レビューが続けられます。",[12,1190,1191,1194,1196,1197,1200],{},[42,1192,1193],{},"重大度オーバーライドを他のポリシータイプと組み合わせることはできますか？",[1186,1195],{},"\nはい。重大度オーバーライドは ",[86,1198,1199],{},"default"," ブランチの検出結果に適用され、GitLabの脆弱性レポートに表示される脆弱性に影響します。その後、マージリクエスト承認ポリシーを使用して新たに検出された検出結果をゲートできます。",[12,1202,1203,1206,1208],{},[42,1204,1205],{},"重大度オーバーライドは既存の脆弱性に遡及して適用されますか？",[1186,1207],{},"\nはい。重大度オーバーライドポリシーが適用されると、次のデフォルトブランチパイプライン実行時に、ステータスが「Needs triage」または「Confirmed」の一致する脆弱性が1回につき最大1,000件処理されます。",[12,1210,1211,1214,1216],{},[42,1212,1213],{},"2つのポリシーが競合する重大度を設定した場合、どうなりますか？",[1186,1215],{},"\n手動オーバーライドは常に優先されます。ポリシーの競合については、最後に適用されたポリシーが優先されます。重複する条件を避けるため、定期的にポリシーを見直してください。",[12,1218,1219,1222,1224],{},[42,1220,1221],{},"開発者は重大度オーバーライドポリシーを回避できますか？",[1186,1223],{},"\nいいえ。ポリシーはアクセスが制限されたセキュリティポリシープロジェクトで管理されます。開発者はポリシーを変更したり無効にしたりできません。権限を持つユーザーは個々の脆弱性に手動オーバーライドを適用でき、これが優先されます。",[1226,1227,1228],"blockquote",{},[12,1229,1230,1231,1236,1237,1242],{},"脆弱性レポートに実際のリスクを反映させる準備はできていますか？",[26,1232,1235],{"href":1233,"rel":1234},"https://docs.gitlab.com/ja-jp/user/application_security/policies/vulnerability_management_policy/#severity-override-policies",[],"重大度オーバーライドポリシーのドキュメント","で詳細を確認するか、",[26,1238,1241],{"href":1239,"rel":1240},"https://about.gitlab.com/ja-jp/free-trial/",[],"GitLab Ultimateの無料トライアル","を開始して今すぐお試しください。",[1244,1245,1246],"style",{},"html pre.shiki code .shJU0, html code.shiki .shJU0{--shiki-default:#22863A}html pre.shiki code .sgsFI, html code.shiki .sgsFI{--shiki-default:#24292E}html pre.shiki code .sYBdl, html code.shiki .sYBdl{--shiki-default:#032F62}html pre.shiki code .sYu0t, html code.shiki .sYu0t{--shiki-default:#005CC5}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}",{"title":84,"searchDepth":103,"depth":103,"links":1248},[1249,1250,1257,1260],{"id":21,"depth":103,"text":21},{"id":63,"depth":103,"text":63,"children":1251},[1252,1253,1254,1255,1256],{"id":70,"depth":119,"text":71},{"id":282,"depth":119,"text":283},{"id":472,"depth":119,"text":473},{"id":624,"depth":119,"text":625},{"id":781,"depth":119,"text":782},{"id":971,"depth":103,"text":971,"children":1258},[1259],{"id":1014,"depth":119,"text":1014},{"id":1179,"depth":103,"text":1179},"security","2026-05-13","デフォルトのCVSSスコアは実際のリスクを反映していません。GitLabの重大度オーバーライドポリシーを使用すると、CVE、CWE、ファイルパス、ディレクトリを条件として重大度を自動調整し、実際のリスクに即した脆弱性レポートを実現できます。","md",null,false,"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772630163/akp8ly2mrsfrhsb0liyb.png",{},true,"/ja-jp/blog/severity-override-vulnerability-management-policy",{"config":1272,"title":5,"description":1263,"ogImage":1273},{"noIndex":1266},"https://res.cloudinary.com/about-gitlab-com/image/upload/f_auto,q_auto,c_lfill/v1772630163/akp8ly2mrsfrhsb0liyb.webp","severity-override-vulnerability-management-policy","ja-jp/blog/severity-override-vulnerability-management-policy",[1261,1277],"tutorial","BlogPost","2026-05-14","KdWgxNjMI0BSJk56x5wcy9vLmWREmouY4sV6h3RomUg",{"logo":1282,"freeTrial":1287,"sales":1292,"login":1297,"items":1302,"search":1631,"minimal":1664,"duo":1681,"switchNav":1690,"pricingDeployment":1701},{"config":1283},{"href":1284,"dataGaName":1285,"dataGaLocation":1286},"/ja-jp/","gitlab logo","header",{"text":1288,"config":1289},"無料トライアルを開始",{"href":1290,"dataGaName":1291,"dataGaLocation":1286},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com/ja-jp&glm_content=default-saas-trial/","free trial",{"text":1293,"config":1294},"デモをリクエスト",{"href":1295,"dataGaName":1296,"dataGaLocation":1286},"/ja-jp/sales/?contact-topic=request-demo","sales",{"text":1298,"config":1299},"サインイン",{"href":1300,"dataGaName":1301,"dataGaLocation":1286},"https://gitlab.com/users/sign_in/","sign in",[1303,1332,1434,1439,1553,1609],{"text":1304,"config":1305,"menu":1307},"プラットフォーム",{"dataNavLevelOne":1306},"platform",{"type":1308,"columns":1309},"cards",[1310,1316,1324],{"title":1304,"description":1311,"link":1312},"DevSecOpsに特化したインテリジェントオーケストレーションプラットフォーム",{"text":1313,"config":1314},"プラットフォームの詳細はこちら",{"href":1315,"dataGaName":1306,"dataGaLocation":1286},"/ja-jp/platform/",{"title":1317,"description":1318,"link":1319},"GitLab Duo Agent Platform","ソフトウェアライフサイクル全体を支えるエージェント型AI",{"text":1320,"config":1321},"GitLab Duoのご紹介",{"href":1322,"dataGaName":1323,"dataGaLocation":1286},"/ja-jp/gitlab-duo-agent-platform/","gitlab duo agent platform",{"title":1325,"description":1326,"link":1327},"GitLabが選ばれる理由","エンタープライズがGitLabを選ぶ主な理由をご覧ください",{"text":1328,"config":1329},"詳細はこちら",{"href":1330,"dataGaName":1331,"dataGaLocation":1286},"/ja-jp/why-gitlab/","why gitlab",{"text":1333,"left":1269,"config":1334,"menu":1336},"製品",{"dataNavLevelOne":1335},"solutions",{"type":1337,"link":1338,"columns":1342,"feature":1413},"lists",{"text":1339,"config":1340},"すべてのソリューションを表示",{"href":1341,"dataGaName":1335,"dataGaLocation":1286},"/ja-jp/solutions/",[1343,1368,1391],{"title":1344,"description":1345,"link":1346,"items":1351},"自動化","CI/CDと自動化でデプロイを加速",{"config":1347},{"icon":1348,"href":1349,"dataGaName":1350,"dataGaLocation":1286},"AutomatedCodeAlt","/ja-jp/solutions/delivery-automation/","automated software delivery",[1352,1356,1359,1364],{"text":1353,"config":1354},"CI/CD",{"href":1355,"dataGaLocation":1286,"dataGaName":1353},"/ja-jp/solutions/continuous-integration/",{"text":1317,"config":1357},{"href":1322,"dataGaLocation":1286,"dataGaName":1358},"gitlab duo agent platform - product menu",{"text":1360,"config":1361},"ソースコード管理",{"href":1362,"dataGaLocation":1286,"dataGaName":1363},"/ja-jp/solutions/source-code-management/","Source Code Management",{"text":1365,"config":1366},"自動化されたソフトウェアデリバリー",{"href":1349,"dataGaLocation":1286,"dataGaName":1367},"Automated software delivery",{"title":1369,"description":1370,"link":1371,"items":1376},"セキュリティ","セキュリティを犠牲にすることなくコード作成を高速化",{"config":1372},{"href":1373,"dataGaName":1374,"dataGaLocation":1286,"icon":1375},"/ja-jp/solutions/application-security-testing/","security and compliance","ShieldCheckLight",[1377,1381,1386],{"text":1378,"config":1379},"アプリケーションセキュリティテスト",{"href":1373,"dataGaName":1380,"dataGaLocation":1286},"Application security testing",{"text":1382,"config":1383},"ソフトウェアサプライチェーンセキュリティ",{"href":1384,"dataGaLocation":1286,"dataGaName":1385},"/ja-jp/solutions/supply-chain/","Software supply chain security",{"text":1387,"config":1388},"ソフトウェアコンプライアンス",{"href":1389,"dataGaName":1390,"dataGaLocation":1286},"/ja-jp/solutions/software-compliance/","software compliance",{"title":1392,"link":1393,"items":1398},"測定",{"config":1394},{"icon":1395,"href":1396,"dataGaName":1397,"dataGaLocation":1286},"DigitalTransformation","/ja-jp/solutions/visibility-measurement/","visibility and measurement",[1399,1403,1408],{"text":1400,"config":1401},"可視性と測定",{"href":1396,"dataGaLocation":1286,"dataGaName":1402},"Visibility and Measurement",{"text":1404,"config":1405},"バリューストリーム管理",{"href":1406,"dataGaLocation":1286,"dataGaName":1407},"/ja-jp/solutions/value-stream-management/","Value Stream Management",{"text":1409,"config":1410},"分析とインサイト",{"href":1411,"dataGaLocation":1286,"dataGaName":1412},"/ja-jp/solutions/analytics-and-insights/","Analytics and insights",{"title":1414,"type":1337,"items":1415},"GitLabが活躍する場所",[1416,1422,1428],{"text":1417,"config":1418},"大企業",{"icon":1419,"href":1420,"dataGaLocation":1286,"dataGaName":1421},"Building","/ja-jp/enterprise/","enterprise",{"text":1423,"config":1424},"スモールビジネス",{"icon":1425,"href":1426,"dataGaLocation":1286,"dataGaName":1427},"Work","/ja-jp/small-business/","small business",{"text":1429,"config":1430},"公共部門",{"icon":1431,"href":1432,"dataGaLocation":1286,"dataGaName":1433},"Organization","/ja-jp/solutions/public-sector/","public sector",{"text":1435,"config":1436},"価格",{"href":1437,"dataGaName":1438,"dataGaLocation":1286,"dataNavLevelOne":1438},"/ja-jp/pricing/","pricing",{"text":1440,"config":1441,"menu":1443},"関連リソース",{"dataNavLevelOne":1442},"resources",{"type":1337,"link":1444,"columns":1448,"feature":1542},{"text":1445,"config":1446},"すべてのリソースを表示",{"href":1447,"dataGaName":1442,"dataGaLocation":1286},"/ja-jp/resources/",[1449,1482,1509],{"title":1450,"items":1451},"はじめに",[1452,1457,1462,1467,1472,1477],{"text":1453,"config":1454},"インストール",{"href":1455,"dataGaName":1456,"dataGaLocation":1286},"/ja-jp/install/","install",{"text":1458,"config":1459},"クイックスタートガイド",{"href":1460,"dataGaName":1461,"dataGaLocation":1286},"/ja-jp/get-started/","quick setup checklists",{"text":1463,"config":1464},"学ぶ",{"href":1465,"dataGaLocation":1286,"dataGaName":1466},"https://university.gitlab.com/","learn",{"text":1468,"config":1469},"製品ドキュメント",{"href":1470,"dataGaName":1471,"dataGaLocation":1286},"https://docs.gitlab.com/ja-jp/","product documentation",{"text":1473,"config":1474},"ベストプラクティスビデオ",{"href":1475,"dataGaName":1476,"dataGaLocation":1286},"/ja-jp/getting-started-videos/","best practice videos",{"text":1478,"config":1479},"インテグレーション",{"href":1480,"dataGaName":1481,"dataGaLocation":1286},"/ja-jp/integrations/","integrations",{"title":1483,"items":1484},"検索する",[1485,1490,1495,1500,1504],{"text":1486,"config":1487},"お客様成功事例",{"href":1488,"dataGaName":1489,"dataGaLocation":1286},"/ja-jp/customers/","customer success stories",{"text":1491,"config":1492},"ブログ",{"href":1493,"dataGaName":1494,"dataGaLocation":1286},"/ja-jp/blog/","blog",{"text":1496,"config":1497},"Demo Hub",{"href":1498,"dataGaName":1499,"dataGaLocation":1286},"/ja-jp/demo-hub/","demo hub",{"text":1501,"config":1502},"The Source",{"href":1503,"dataGaName":1494,"dataGaLocation":1286},"/ja-jp/the-source/",{"text":1505,"config":1506},"リモート",{"href":1507,"dataGaName":1508,"dataGaLocation":1286},"https://handbook.gitlab.com/handbook/company/culture/all-remote/","remote",{"title":1510,"items":1511},"つなげる",[1512,1517,1522,1527,1532,1537],{"text":1513,"config":1514},"GitLabサービス",{"href":1515,"dataGaName":1516,"dataGaLocation":1286},"/ja-jp/services/","services",{"text":1518,"config":1519},"コントリビュート",{"href":1520,"dataGaName":1521,"dataGaLocation":1286},"https://contributors.gitlab.com","contribute",{"text":1523,"config":1524},"コミュニティ",{"href":1525,"dataGaName":1526,"dataGaLocation":1286},"/community/","community",{"text":1528,"config":1529},"フォーラム",{"href":1530,"dataGaName":1531,"dataGaLocation":1286},"https://forum.gitlab.com/","forum",{"text":1533,"config":1534},"イベント",{"href":1535,"dataGaName":1536,"dataGaLocation":1286},"/events/","events",{"text":1538,"config":1539},"パートナー",{"href":1540,"dataGaName":1541,"dataGaLocation":1286},"/ja-jp/partners/","partners",{"config":1543,"title":1546,"text":1547,"link":1548},{"background":1544,"textColor":1545},"url('https://res.cloudinary.com/about-gitlab-com/image/upload/v1777322348/qpq8yrgn8knii57omj0c.png')","#000","GitLabの最新情報","最新の機能と改善点に関する情報をお届けします。",{"text":1549,"config":1550},"最新情報を読む",{"href":1551,"dataGaName":1552,"dataGaLocation":1286},"/ja-jp/whats-new/","whats new",{"text":1554,"config":1555,"menu":1557},"企業情報",{"dataNavLevelOne":1556},"company",{"type":1337,"columns":1558},[1559],{"items":1560},[1561,1566,1572,1574,1579,1584,1589,1594,1599,1604],{"text":1562,"config":1563},"GitLabについて",{"href":1564,"dataGaName":1565,"dataGaLocation":1286},"/ja-jp/company/","about",{"text":1567,"config":1568,"footerGa":1571},"採用情報",{"href":1569,"dataGaName":1570,"dataGaLocation":1286},"/jobs/","jobs",{"dataGaName":1570},{"text":1533,"config":1573},{"href":1535,"dataGaName":1536,"dataGaLocation":1286},{"text":1575,"config":1576},"経営陣",{"href":1577,"dataGaName":1578,"dataGaLocation":1286},"/company/team/e-group/","leadership",{"text":1580,"config":1581},"ハンドブック",{"href":1582,"dataGaName":1583,"dataGaLocation":1286},"https://handbook.gitlab.com/","handbook",{"text":1585,"config":1586},"投資家向け情報",{"href":1587,"dataGaName":1588,"dataGaLocation":1286},"https://ir.gitlab.com/overview/default.aspx","investor relations",{"text":1590,"config":1591},"トラストセンター",{"href":1592,"dataGaName":1593,"dataGaLocation":1286},"/ja-jp/security/","trust center",{"text":1595,"config":1596},"AI Transparency Center",{"href":1597,"dataGaName":1598,"dataGaLocation":1286},"/ja-jp/ai-transparency-center/","ai transparency center",{"text":1600,"config":1601},"ニュースレター",{"href":1602,"dataGaName":1603,"dataGaLocation":1286},"/company/contact/#contact-forms","newsletter",{"text":1605,"config":1606},"プレス",{"href":1607,"dataGaName":1608,"dataGaLocation":1286},"/press/","press",{"text":1610,"config":1611,"menu":1612},"お問い合わせ",{"dataNavLevelOne":1556},{"type":1337,"columns":1613},[1614],{"items":1615},[1616,1621,1626],{"text":1617,"config":1618},"お問い合わせはこちら",{"href":1619,"dataGaName":1620,"dataGaLocation":1286},"/ja-jp/sales/","talk to sales",{"text":1622,"config":1623},"サポートを受ける",{"href":1624,"dataGaName":1625,"dataGaLocation":1286},"https://support.gitlab.com/hc/en-us","support portal",{"text":1627,"config":1628},"カスタマーポータル",{"href":1629,"dataGaName":1630,"dataGaLocation":1286},"https://customers.gitlab.com/customers/sign_in/","customer portal",{"close":1632,"login":1633,"suggestions":1640},"閉じる",{"text":1634,"link":1635},"リポジトリとプロジェクトを検索するには、次にログインします",{"text":1636,"config":1637},"GitLab.com",{"href":1300,"dataGaName":1638,"dataGaLocation":1639},"search login","search",{"text":1641,"default":1642},"提案",[1643,1645,1650,1652,1656,1660],{"text":1317,"config":1644},{"href":1322,"dataGaName":1317,"dataGaLocation":1639},{"text":1646,"config":1647},"コード提案（AI）",{"href":1648,"dataGaName":1649,"dataGaLocation":1639},"/ja-jp/solutions/code-suggestions/","Code Suggestions (AI)",{"text":1353,"config":1651},{"href":1355,"dataGaName":1353,"dataGaLocation":1639},{"text":1653,"config":1654},"GitLab on AWS",{"href":1655,"dataGaName":1653,"dataGaLocation":1639},"/ja-jp/partners/technology-partners/aws/",{"text":1657,"config":1658},"GitLab on Google Cloud",{"href":1659,"dataGaName":1657,"dataGaLocation":1639},"/ja-jp/partners/technology-partners/google-cloud-platform/",{"text":1661,"config":1662},"GitLabを選ぶ理由",{"href":1330,"dataGaName":1663,"dataGaLocation":1639},"Why GitLab?",{"freeTrial":1665,"mobileIcon":1669,"desktopIcon":1674,"secondaryButton":1677},{"text":1288,"config":1666},{"href":1667,"dataGaName":1291,"dataGaLocation":1668},"https://gitlab.com/-/trials/new/","nav",{"altText":1670,"config":1671},"GitLabアイコン",{"src":1672,"dataGaName":1673,"dataGaLocation":1668},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203874/jypbw1jx72aexsoohd7x.svg","gitlab icon",{"altText":1670,"config":1675},{"src":1676,"dataGaName":1673,"dataGaLocation":1668},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203875/gs4c8p8opsgvflgkswz9.svg",{"text":1450,"config":1678},{"href":1679,"dataGaName":1680,"dataGaLocation":1668},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com/ja-jp/get-started/","get started",{"freeTrial":1682,"mobileIcon":1686,"desktopIcon":1688},{"text":1683,"config":1684},"GitLab Duoの詳細について",{"href":1322,"dataGaName":1685,"dataGaLocation":1668},"gitlab duo",{"altText":1670,"config":1687},{"src":1672,"dataGaName":1673,"dataGaLocation":1668},{"altText":1670,"config":1689},{"src":1676,"dataGaName":1673,"dataGaLocation":1668},{"button":1691,"mobileIcon":1696,"desktopIcon":1698},{"text":1692,"config":1693},"/switch",{"href":1694,"dataGaName":1695,"dataGaLocation":1668},"#contact","switch",{"altText":1670,"config":1697},{"src":1672,"dataGaName":1673,"dataGaLocation":1668},{"altText":1670,"config":1699},{"src":1700,"dataGaName":1673,"dataGaLocation":1668},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1773335277/ohhpiuoxoldryzrnhfrh.png",{"freeTrial":1702,"mobileIcon":1707,"desktopIcon":1709},{"text":1703,"config":1704},"料金ページに戻る",{"href":1437,"dataGaName":1705,"dataGaLocation":1668,"icon":1706},"back to pricing","GoBack",{"altText":1670,"config":1708},{"src":1672,"dataGaName":1673,"dataGaLocation":1668},{"altText":1670,"config":1710},{"src":1676,"dataGaName":1673,"dataGaLocation":1668},{"title":1712,"button":1713,"config":1717},"GitLab Orbitが登場: AIエージェントのためのコンテキストレイヤー",{"text":1328,"config":1714},{"href":1715,"dataGaName":1716,"dataGaLocation":1286},"/ja-jp/gitlab-orbit/","orbit",{"layout":1718,"disabled":1266},"release",{"data":1720},{"text":1721,"source":1722,"edit":1728,"contribute":1733,"config":1738,"items":1743,"minimal":1952},"GitはSoftware Freedom Conservancyの商標です。当社は「GitLab」をライセンスに基づいて使用しています",{"text":1723,"config":1724},"ページのソースを表示",{"href":1725,"dataGaName":1726,"dataGaLocation":1727},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/","page source","footer",{"text":1729,"config":1730},"このページを編集",{"href":1731,"dataGaName":1732,"dataGaLocation":1727},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/content/","web ide",{"text":1734,"config":1735},"ご協力をお願いします",{"href":1736,"dataGaName":1737,"dataGaLocation":1727},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/CONTRIBUTING.md/","please contribute",{"twitter":1739,"facebook":1740,"youtube":1741,"linkedin":1742},"https://twitter.com/gitlab","https://www.facebook.com/gitlab","https://www.youtube.com/channel/UCnMGQ8QHMAnVIsI3xJrihhg","https://www.linkedin.com/company/gitlab-com",[1744,1789,1842,1885,1919],{"title":1435,"links":1745,"subMenu":1760},[1746,1750,1755],{"text":1747,"config":1748},"プランの表示",{"href":1437,"dataGaName":1749,"dataGaLocation":1727},"view plans",{"text":1751,"config":1752},"Premiumを選ぶ理由",{"href":1753,"dataGaName":1754,"dataGaLocation":1727},"/ja-jp/pricing/premium/","why premium",{"text":1756,"config":1757},"Ultimateを選ぶ理由",{"href":1758,"dataGaName":1759,"dataGaLocation":1727},"/ja-jp/pricing/ultimate/","why ultimate",[1761],{"title":1610,"links":1762},[1763,1765,1767,1769,1774,1779,1784],{"text":1610,"config":1764},{"href":1619,"dataGaName":1296,"dataGaLocation":1727},{"text":1622,"config":1766},{"href":1624,"dataGaName":1625,"dataGaLocation":1727},{"text":1627,"config":1768},{"href":1629,"dataGaName":1630,"dataGaLocation":1727},{"text":1770,"config":1771},"ステータス",{"href":1772,"dataGaName":1773,"dataGaLocation":1727},"https://status.gitlab.com/","status",{"text":1775,"config":1776},"利用規約",{"href":1777,"dataGaName":1778,"dataGaLocation":1727},"/terms/","terms of use",{"text":1780,"config":1781},"プライバシーに関する声明",{"href":1782,"dataGaName":1783,"dataGaLocation":1727},"/ja-jp/privacy/","privacy statement",{"text":1785,"config":1786},"Cookie 優先設定",{"dataGaName":1787,"dataGaLocation":1727,"id":1788,"isOneTrustButton":1269},"cookie preferences","ot-sdk-btn",{"title":1333,"links":1790,"subMenu":1799},[1791,1795],{"text":1792,"config":1793},"DevSecOpsプラットフォーム",{"href":1315,"dataGaName":1794,"dataGaLocation":1727},"devsecops platform",{"text":1796,"config":1797},"AI支援開発",{"href":1322,"dataGaName":1798,"dataGaLocation":1727},"ai-assisted development",[1800],{"title":1801,"links":1802},"トピック",[1803,1807,1812,1817,1822,1827,1832,1837],{"text":1353,"config":1804},{"href":1805,"dataGaName":1806,"dataGaLocation":1727},"/ja-jp/topics/ci-cd/","cicd",{"text":1808,"config":1809},"GitOps",{"href":1810,"dataGaName":1811,"dataGaLocation":1727},"/ja-jp/topics/gitops/","gitops",{"text":1813,"config":1814},"DevOps",{"href":1815,"dataGaName":1816,"dataGaLocation":1727},"/ja-jp/topics/devops/","devops",{"text":1818,"config":1819},"バージョン管理",{"href":1820,"dataGaName":1821,"dataGaLocation":1727},"/ja-jp/topics/version-control/","version control",{"text":1823,"config":1824},"DevSecOps",{"href":1825,"dataGaName":1826,"dataGaLocation":1727},"/ja-jp/topics/devsecops/","devsecops",{"text":1828,"config":1829},"クラウドネイティブ",{"href":1830,"dataGaName":1831,"dataGaLocation":1727},"/ja-jp/topics/cloud-native/","cloud native",{"text":1833,"config":1834},"コーディングのためのAI",{"href":1835,"dataGaName":1836,"dataGaLocation":1727},"/ja-jp/topics/devops/ai-for-coding/","ai for coding",{"text":1838,"config":1839},"エージェント型AI",{"href":1840,"dataGaName":1841,"dataGaLocation":1727},"/ja-jp/topics/agentic-ai/","agentic ai",{"title":1843,"links":1844},"ソリューション",[1845,1848,1850,1855,1859,1862,1865,1868,1870,1872,1875,1880],{"text":1378,"config":1846},{"href":1373,"dataGaName":1847,"dataGaLocation":1727},"Application Security Testing",{"text":1365,"config":1849},{"href":1349,"dataGaName":1350,"dataGaLocation":1727},{"text":1851,"config":1852},"アジャイル開発",{"href":1853,"dataGaName":1854,"dataGaLocation":1727},"/ja-jp/solutions/agile-delivery/","agile delivery",{"text":1856,"config":1857},"SCM",{"href":1362,"dataGaName":1858,"dataGaLocation":1727},"source code management",{"text":1353,"config":1860},{"href":1355,"dataGaName":1861,"dataGaLocation":1727},"continuous integration & delivery",{"text":1404,"config":1863},{"href":1406,"dataGaName":1864,"dataGaLocation":1727},"value stream management",{"text":1808,"config":1866},{"href":1867,"dataGaName":1811,"dataGaLocation":1727},"/ja-jp/solutions/gitops/",{"text":1417,"config":1869},{"href":1420,"dataGaName":1421,"dataGaLocation":1727},{"text":1423,"config":1871},{"href":1426,"dataGaName":1427,"dataGaLocation":1727},{"text":1873,"config":1874},"公共機関",{"href":1432,"dataGaName":1433,"dataGaLocation":1727},{"text":1876,"config":1877},"教育",{"href":1878,"dataGaName":1879,"dataGaLocation":1727},"/ja-jp/solutions/education/","education",{"text":1881,"config":1882},"金融サービス",{"href":1883,"dataGaName":1884,"dataGaLocation":1727},"/ja-jp/solutions/finance/","financial services",{"title":1886,"links":1887},"リソース",[1888,1890,1892,1894,1898,1900,1903,1905,1907,1909,1911,1913,1915,1917],{"text":1453,"config":1889},{"href":1455,"dataGaName":1456,"dataGaLocation":1727},{"text":1458,"config":1891},{"href":1460,"dataGaName":1461,"dataGaLocation":1727},{"text":1463,"config":1893},{"href":1465,"dataGaName":1466,"dataGaLocation":1727},{"text":1468,"config":1895},{"href":1896,"dataGaName":1897,"dataGaLocation":1727},"https://docs.gitlab.com/ja-jp","docs",{"text":1491,"config":1899},{"href":1493,"dataGaName":1494,"dataGaLocation":1727},{"text":1901,"config":1902},"最新リリース",{"href":1551,"dataGaName":1552,"dataGaLocation":1727},{"text":1486,"config":1904},{"href":1488,"dataGaName":1489,"dataGaLocation":1727},{"text":1505,"config":1906},{"href":1507,"dataGaName":1508,"dataGaLocation":1727},{"text":1513,"config":1908},{"href":1515,"dataGaName":1516,"dataGaLocation":1727},{"text":1518,"config":1910},{"href":1520,"dataGaName":1521,"dataGaLocation":1727},{"text":1523,"config":1912},{"href":1525,"dataGaName":1526,"dataGaLocation":1727},{"text":1528,"config":1914},{"href":1530,"dataGaName":1531,"dataGaLocation":1727},{"text":1533,"config":1916},{"href":1535,"dataGaName":1536,"dataGaLocation":1727},{"text":1538,"config":1918},{"href":1540,"dataGaName":1541,"dataGaLocation":1727},{"title":1920,"links":1921},"会社情報",[1922,1924,1926,1928,1930,1932,1936,1941,1943,1945,1947],{"text":1562,"config":1923},{"href":1564,"dataGaName":1556,"dataGaLocation":1727},{"text":1567,"config":1925},{"href":1569,"dataGaName":1570,"dataGaLocation":1727},{"text":1575,"config":1927},{"href":1577,"dataGaName":1578,"dataGaLocation":1727},{"text":1580,"config":1929},{"href":1582,"dataGaName":1583,"dataGaLocation":1727},{"text":1585,"config":1931},{"href":1587,"dataGaName":1588,"dataGaLocation":1727},{"text":1933,"config":1934},"Sustainability",{"href":1935,"dataGaName":1933,"dataGaLocation":1727},"/sustainability/",{"text":1937,"config":1938},"ダイバーシティ、インクルージョン、ビロンギング（DIB）",{"href":1939,"dataGaName":1940,"dataGaLocation":1727},"/ja-jp/diversity-inclusion-belonging/","Diversity, inclusion and belonging",{"text":1590,"config":1942},{"href":1592,"dataGaName":1593,"dataGaLocation":1727},{"text":1600,"config":1944},{"href":1602,"dataGaName":1603,"dataGaLocation":1727},{"text":1605,"config":1946},{"href":1607,"dataGaName":1608,"dataGaLocation":1727},{"text":1948,"config":1949},"現代奴隷制の透明性に関する声明",{"href":1950,"dataGaName":1951,"dataGaLocation":1727},"https://handbook.gitlab.com/handbook/legal/modern-slavery-act-transparency-statement/","modern slavery transparency statement",{"items":1953},[1954,1956,1959],{"text":1775,"config":1955},{"href":1777,"dataGaName":1778,"dataGaLocation":1727},{"text":1957,"config":1958},"Cookieの設定",{"dataGaName":1787,"dataGaLocation":1727,"id":1788,"isOneTrustButton":1269},{"text":1780,"config":1960},{"href":1782,"dataGaName":1783,"dataGaLocation":1727},[1962],{"id":1963,"title":7,"body":1265,"config":1964,"content":1966,"description":1265,"extension":1970,"meta":1971,"navigation":1269,"path":1972,"seo":1973,"stem":1974,"__hash__":1975},"blogAuthors/en-us/blog/authors/grant-hickman.yml",{"template":1965},"BlogAuthor",{"name":7,"config":1967},{"headshot":1968,"ctfId":1969},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1749682570/Blog/Author%20Headshots/g.png","ghickman","yml",{},"/en-us/blog/authors/grant-hickman",{},"en-us/blog/authors/grant-hickman","3OY7ZjUzeOb_im7m1kimID61q_0OEhuzipAc3AHq2WM",[1977,1986,1994],{"title":1978,"description":1979,"heroImage":1980,"category":1261,"date":1981,"authors":1982,"slug":1985,"externalUrl":1265},"GitLab Secrets ManagerがESO、Terraform、APIに対応","スタック全体の認証情報管理をシンプルに。GitLab Secrets Managerは External Secrets Operator（ESO）、Terraform、Secrets Manager APIに対応し、CI/CD以外の ワークフローからもシークレットを安全に取得できます。","https://res.cloudinary.com/about-gitlab-com/image/upload/v1759320418/xjmqcozxzt4frx0hori3.png","2026-08-06",[1983,1984],"Erick Bajao","Joe Randazzo","gitlab-secrets-manager-add-eso-terraform-api-support",{"title":1987,"description":1988,"heroImage":1989,"category":1261,"date":1990,"authors":1991,"slug":1993,"externalUrl":1265},"Claudeが書き、GitLabがつなぐ：本番環境まで途切れないセキュリティ","Claude Securityはコーディングセッション内で脆弱性を検出します。そこから先はGitLabが引き継ぎ、スキャン、ポリシーの適用、そしてソフトウェアライフサイクル全体の監査エビデンス作成までを担います。","https://res.cloudinary.com/about-gitlab-com/image/upload/v1756122536/akivvcnafog9c4dhhzkp.png","2026-08-03",[1992],"Alisa Ho","claude-security-and-gitlab",{"title":1995,"description":1996,"heroImage":1997,"category":1261,"date":1998,"authors":1999,"slug":2001,"externalUrl":1265},"GitLab Duoセキュリティレビューでスキャナーが見逃すロジックの欠陥を検出","AIによるセキュリティ推論で、コードレビューの段階のうちに認可の不備やビジネスロジックのエラー、レース条件を検出します。","https://res.cloudinary.com/about-gitlab-com/image/upload/v1783980535/t3gez0gpayfndrhncunf.png","2026-07-16",[2000],"Mark Settle","gitlab-duo-security-review-flow",{"promotions":2003},[2004,2018,2030,2041],{"id":2005,"categories":2006,"header":2008,"text":2009,"button":2010,"image":2015},"ai-modernization",[2007],"ai","AIの真価、組織全体で発揮できていますか？","所要時間は5分以内です",{"text":2011,"config":2012},"AI成熟度スコアを確認する",{"href":2013,"dataGaName":2014,"dataGaLocation":1494},"/ja-jp/assessments/ai-modernization-assessment/","modernization assessment",{"config":2016},{"src":2017},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/qix0m7kwnd8x2fh1zq49.png",{"id":2019,"categories":2020,"header":2022,"text":2009,"button":2023,"image":2027},"devops-modernization",[2021,1826],"product","単にツールを管理するだけでなく、イノベーションを提供していますか？",{"text":2024,"config":2025},"DevOps成熟度スコアを確認しましょう",{"href":2026,"dataGaName":2014,"dataGaLocation":1494},"/ja-jp/assessments/devops-modernization-assessment/",{"config":2028},{"src":2029},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138785/eg818fmakweyuznttgid.png",{"id":2031,"categories":2032,"header":2033,"text":2009,"button":2034,"image":2038},"security-modernization",[1261],"スピードのためにセキュリティを犠牲にしていませんか？",{"text":2035,"config":2036},"セキュリティ成熟度スコアを確認しましょう",{"href":2037,"dataGaName":2014,"dataGaLocation":1494},"/ja-jp/assessments/security-modernization-assessment/",{"config":2039},{"src":2040},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/p4pbqd9nnjejg5ds6mdk.png",{"id":2042,"paths":2043,"header":2046,"text":2047,"button":2048,"image":2053},"github-azure-migration",[2044,2045],"migration-from-azure-devops-to-gitlab","integrating-azure-devops-scm-and-gitlab","チームはGitHubのAzure移行に対応できていますか？","GitHubはすでにAzureを基盤として再構築を進めています。それがあなたのチームにとって何を意味するのか、ご確認ください。",{"text":2049,"config":2050},"GitLabとGitHubの比較を見る",{"href":2051,"dataGaName":2052,"dataGaLocation":1494},"/ja-jp/compare/gitlab-vs-github/github-azure-migration/","github azure migration",{"config":2054},{"src":2029},{"header":2056,"blurb":2057,"button":2058,"secondaryButton":2062},"今すぐ開発をスピードアップ","DevSecOpsに特化したインテリジェントオーケストレーションプラットフォームで実現できることをご確認ください。\n",{"text":1288,"config":2059},{"href":2060,"dataGaName":1291,"dataGaLocation":2061},"https://gitlab.com/-/trial_registrations/new?glm_content=default-saas-trial&glm_source=about.gitlab.com/ja-jp/","feature",{"text":1610,"config":2063},{"href":1619,"dataGaName":1296,"dataGaLocation":2061},1786803771173]