## What A new Automated Triage and Remediation tab in Security Configuration at the top-level group, next to Scanners. ATR profiles live here only, not under Scanners. ## Cards - **Not enabled**: N of M projects have no Automated Triage and Remediation profile. Links to Inventory filtered. - **Flows on**: X of Y flows are on for this group. If any are off: "profiles that include them skip those steps everywhere." Links to group settings, not a project list. A card, not an alert. - **Profiles in use**: N, with the per-preset breakdown (Standard on A, Conservative on B, Proactive on C). On-demand card removed (Oct 15). A fourth card, "Never ran", is a candidate once the column in &22125 exposes that state; not required for 19.6. ## Profile list One row per profile. View details opens the same drawer as #634570. Profile names are not clickable; rows do not expand. One way to see a profile. ## First-run and post-apply states Empty state before any profile exists: explains what ATR does and offers "Enable" into the wizard (&23678). Post-apply state after the first rollout: pending design, Celeste, week of Oct 20. ## Design Celeste's prototype, 19.6 slice. Familiarity with the Scanners tab matters more than identical wording. ## Priority Fourth of the five 19.6 pieces, after drawer, column, and wizard. ## Parent &23192 ### References: - prototype: https://atr-prototype-201201.gitlab.io/#/version/enablement/automation-first-config?tab=auto-resolve, with a profile applied. The source is `AtrProfilesOverview.vue` in https://gitlab.com/gitlab-com/gitlab-ux/security-compliance-ux/srm-ux-group/atr-prototype, `main`, read 2026-10-21. - the tab and its empty state are https://gitlab.com/gitlab-org/gitlab/-/work_items/633906. This issue fills the tab once a project in the group has a profile. - reuse the Scanners tab's layout: `group_scanners_overview.vue` already renders `statistics_card_row.vue`, a `GlTable` and `projects_list_modal.vue` - the profiles: `availableSecurityScanProfiles(gitlabRecommended: true)` filtered to `scanType: TRIAGE_AND_REMEDIATION`, as the drawer in https://gitlab.com/gitlab-org/gitlab/-/work_items/633881 reads them - `Manage profile` opens the drawer from https://gitlab.com/gitlab-org/gitlab/-/work_items/633881 with no project, view only - counts, on master: | Number | Source | |---|---| | All projects in the group | `group.securityPostureCounters.total` | | Projects with each capability | `group.triageAndRemediationCoverageCounters(triggerType:)`, `enabledCount`, one call per trigger type | | Projects with a triage and remediation profile | `group.securityPostureCounters.withTriageCoverage` ([field](https://gitlab.com/gitlab-org/gitlab/-/blob/master/ee/app/graphql/types/security/security_posture_counters_type.rb?ref_type=heads#L29)). Gal, https://gitlab.com/groups/gitlab-org/-/work_items/23191#note_4127918733 | | Projects with each preset | `projectCount` on each preset. Exact on the top-level group, because every profile belongs to the root group. Subgroups need https://gitlab.com/gitlab-org/gitlab/-/work_items/634870 | | Capabilities off for the group | `group.triageAndRemediationFlowStatuses`, from https://gitlab.com/gitlab-org/gitlab/-/merge_requests/266212+. One `flowStatus` per trigger type. | | Projects with a capability attached but its flow missing | `group.triageAndRemediationCoverageCounters.flowMissingCount`, once https://gitlab.com/gitlab-org/gitlab/-/merge_requests/267294+ merges. Without `triggerType`, it counts any trigger type. | ### Acceptance criteria: - **Given** the `triage_and_remediation_profiles_ui` feature flag is enabled - **Given** at least one project in the group has a triage and remediation profile - **When** the user opens the `Automated Triage and Remediation` tab, **then** it shows a row of stat cards above a table of profiles - `Projects without a profile`: the count, which is `total` minus `withTriageCoverage`, with "N of M projects have no Automated Triage and Remediation profile", and `View projects`, which opens the Security inventory - `Capabilities off for group`: the count of trigger types in `triageAndRemediationFlowStatuses` whose `flowStatus` is off. **When** any are off, **then** the header shows a warning icon. **When** none are, **then** the card says "None, every capability can run". - **Then** the table has one row per preset, applied or not, with Standard first, then by project count - `Profile`: the name, with a summary line such as "Medium severity and above · Default branch only · 5 capabilities". Branch scope waits on the open question in https://gitlab.com/gitlab-org/gitlab/-/work_items/633905. - `Project coverage`: a bar, the share of projects, and "N projects" or "Not applied", followed by the run mode, such as "All capabilities automatic". **When** the tab is on a subgroup, **then** the column is hidden - a `Manage profile` button that opens the preset drawer - Names are not links and rows do not expand - **When** a count fails to load, **then** its card shows a dash, as the Scanners tab does ### Open questions: - `Capabilities off for group`: the prototype's `View details` opens a dialog that can turn capabilities on, while this issue's body links to group settings. Which one? - `View projects` needs a "no triage and remediation profile" filter in the Security inventory. Does the Capabilities filter in https://gitlab.com/gitlab-org/gitlab/-/work_items/634417 cover it? - Does the tab show on subgroups? This issue says top-level group. https://gitlab.com/gitlab-org/gitlab/-/work_items/633906 says either. ### Decisions: - **Cards.** 19.6 ships two: `Projects without a profile` and `Capabilities off for group`. Whether a third and fourth card are worth adding is decided in 19.7. - **View projects.** It links to the Security inventory, not a project list modal. - **Project coverage on subgroups.** Hidden until https://gitlab.com/gitlab-org/gitlab/-/work_items/634870 gives per-subgroup counts. On a subgroup, `projectCount` counts the whole top-level group. <details> <summary>Sources</summary> - Cards and View projects: Michael, 2026-10-26, https://gitlab.com/gitlab-org/gitlab/-/work_items/634571#note_4091715656, answering Celeste's https://gitlab.com/gitlab-org/gitlab/-/work_items/634571#note_4076788072. - Project coverage on subgroups: Miranda, 2026-11-03. </details> ### Out of scope for 19.6: - `Profiles in use`: the count of presets on at least one project, with the breakdown, such as "Standard on 12, Conservative on 3" - `Least covered`: the capability on the fewest projects