> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/security-testing-orchestration/troubleshooting-and-resources/sto-use-cases/set-up-sto-pipelines/set-up-baselines.md).
# Set up target baselines in STO
Every scanned target should have a **baseline**, which represents the root variant, such as the `main` branch of a Git repository, the `latest` tag or a digest (e.g., `@sha256:abc123...`) of a container image. Baselines make it easy to identify issues in the baseline vs. issues in a downstream variant derived from that baseline.
{% hint style="info" %}
**KEY CONCEPTS: TARGET BASELINES**
* [Every scanned target needs a baseline](#every_target_needs_a_baseline) to enable the full suite of STO features.
* You can specify a baseline using a fixed value or a regular expression (RegEx).
* If you always want to compare against a specific variant — such as the `main` branch of your git repository — use a [fixed value](#specify-a-fixed-baseline-for-an-individual-target).
* You might find that the variant you want use as your baseline changes over time. Suppose your team creates a new `X.Y.Z` branch with each release. In this case you can use a [RegEx baseline](#advantages_of_regex_baselines) that updates automatically.
* You can specify a [default RegEx baseline](#default-regular-expressions-for-target-baselines) for each target type. This RegEx will automatically be used as the baseline for any new targets.
* Repositories and images have predefined defaults. For repositories, the default is the `main` or `master` branch. For images, the default is `latest` or the most recently scanned Semantic Versioned release.
{% endhint %}
To view and edit the current baseline for a target, go to **Test Targets**:
Every target needs a baseline
Every target needs a baseline to enable the full suite of STO features. Here's why:
* For developers, it’s critical to distinguish between security issues in the baseline vs. issues in the variant you’re working on. You want to detect and resolve issues in your downstream branch (the variant) before merging, so you don’t introduce them into the main branch (the baseline).
* When your target has a baseline defined, the [Vulnerabilities tab](/security-testing-orchestration/use-sto/sto-security-issues/view-scan-results.md) divides your issues into two lists:
* **Only in <*****target*****>:<*****variant*****>** Issues detected in the scanned variant only.
* **Common to <*****target*****>:<*****baseline*****>** Issues also detected in the target baseline.
* While the **Vulnerabilities** tab highlights downstream issues, the [STO Overview](/security-testing-orchestration/use-sto/sto-security-issues/sto-overview.md) and [Security Testing Dashboard](/security-testing-orchestration/use-sto/sto-dashboards-and-reports/security-testing-dashboard.md) only show baseline issues. These views enable security personnel and other non-developers to monitor, investigate, and address issues in production-ready targets and view vulnerability trends over time.
* In short, baselines make it easy for developers to drill down into “shift-left” issues in the variants they're currently working on, and security personnel to monitor the security posture of production targets.
Benefits of using regular expressions to define baselines
* RegEx baselines more accurately reflect the current "root" element in the context of a real-world software development life cycle. A typical sprint cycle might run like this:
* Publish the current release — for example, `1.2.3` — and merge this branch into `main`.
* Create a "next-release" branch — for example, `1.2.4` — from `main`.
* Create branches from `1.2.4` for different features, hotfixes, and so on.
* When the release is ready to publish, merge the various branches into `1.2.4`.
* Publish the release, merge `1.2.4` into `main`, create a new release branch such as `1.2.5`, and repeat the cycle.
To support proper functioning of STO with this workflow, `1.2.4` more accurately reflects the baseline for the current sprint than `main`. Given a matching RegEx, the first scan after creating the branch establishes `1.2.4` as the current baseline. This remains the current baseline until `1.2.4` gets merged into `main` and `1.2.5` gets created and scanned.
* RegEx baselines make it easier to track the introduction and remediation of specific vulnerabilities. The lifecycle of a specific vulnerability might run like this:
* A new release branch `1.2.3` is created. You scan this branch, which matches your RegEx, and it becomes the current baseline.
* The scan detects a new vulnerability, **vXYZ**, with a severity of MEDIUM.
* A few sprints later, the vulnerability is remediated in a branch that gets merged into `1.2.7`.
* `1.2.7` is scanned before getting merged into `main`, and **vXYZ** is no longer in the scan results.
### Target baselines
You can specify baselines for individual targets.
#### Fixed target baselines
You can specify a fixed value if you know that the baseline for a target will not change.
1. Scan the target with the baseline variant if you haven't yet done so.
2. Go to **Test Targets**.
3. In **Baseline for Comparison**, set the value type to **Fixed** and select the baseline from the menu of scanned variants.
Add shared path for scan results
#### RegEx target baselines
You can specify a RegEx baseline if the baseline changes over time and you can capture it using a regular expression.
{% hint style="info" %}
Harness recommends that you test your regular expression thoroughly before you apply it to a RegEx target. For more information, go to:
* [RegEx baselines: important notes](#regex-baselines-important-notes)
* [Regex baseline examples](#regex-baseline-examples)
{% endhint %}
1. Go to **Test Targets**.
2. Set the value type for the target to **RegEx** and enter the regular expression.
Add shared path for scan results
### Default baselines based on regular expressions
You can specify default baselines for specific target types: code repositories, container images, web/API instances, and infrastructure configurations. STO includes a set of predefined defaults for repository and container image targets.
* For repositories, the baseline is `master` or `main`.
* For container images, the baseline is `latest` or the most recently scanned Semantic Version number if it can be detected, such as
* `1.2.3`
* `v1.15.4`
* STO does not include predefined default RegEx baselines for application instances and configurations.
{% hint style="info" %}
**NOTES**
* Harness recommends that you test your regular expression thoroughly before you apply it to Regex target default. For more information, go to:
* [RegEx baselines: important notes](#regex-baselines-important-notes)
* [Regex baseline examples](#regex-baseline-examples)
{% endhint %}
To specify default RegExes:
1. Go to the **Default** settings page for the scope you want:
* Account settings — all targets in the account
* Organization settings — overrides account defaults
* Project settings — overrides organization defaults
Select scope
2. Go to **Default Settings** > **Security Testing Orchestration**.
Add shared path for scan results
3. Enter the regular expression you want in the **Value** field.
### Regex baselines reference
#### Regex baselines: important notes
* You must use a consistent naming scheme for your scanned variants. This is necessary to ensure that your regular expression captures your baselines consistently and predictably.
* Carefully consider which targets you want to use for your baselines. In general, the baseline should be the root element for all your current variants.
* When you specify a regular expression, the baseline is the *most recently scanned target* that matches the expression.
* Use [re2 format](https://github.com/google/re2/wiki/Syntax) for your expressions.
* Defining regular expressions is outside the scope of this documentation. Harness recommends that you test any regular expressions thoroughly to ensure that the expression matches any variant name that might be used for the scan target.
#### RegEx baseline examples
The following table shows a few simple examples of expressions for specific use cases.
| Variant names | Regular expression | Description |
| --------------------------------------------------------------------------------------- | ------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|