Snyk

Overview

Nucleus integrates open source dependency, SAST, infrastructure as code and container image vulnerability information from Snyk into Nucleus, where they are automatically correlated with source code repositories and container images for a complete picture of application security risk.

This powerful integration incorporates Snyk comprehensive and actionable vulnerability data into Nucleus dashboards, reports, alerts, and automation workflows so the data can be managed centrally with the rest of the enterprise’s vulnerability information. Users can identify vulnerabilities in both direct and indirect dependencies, container images, and Kubernetes applications, while also reporting on data alongside other tools – including penetration tests, cloud configuration audits, and infrastructure scans.

The Snyk connector supports ingesting:

• Package vulnerabilities and license checks from Snyk Open Source and Snyk Container
• Logic / SAST vulnerabilities from Snyk Code
• Misconfigurations as compliance findings from Snyk Infrastructure as Code

Connector Setup

Connector Setup Checklist

Follow the steps in this checklist to successfully set up this connector:

1. API Access
   Generate a Snyk Group or Organisation level service account API key.

2. Connector Configuration
   Create and configure the connector in your Nucleus project.

3. Vulnerability Data Ingestion
   Create a vulnerability scan ingest rules to ingest vulnerabilities from Snyk.

1. API Access

The Snyk connector supports ingesting data from a single organization by creating an Organization service account, or one or more Snyk organizations by creating a Group service account.

1. Follow the Snyk Documentation to set up a Group or Organization level service account.
   b. For Group, the Group Viewer role is required.
   a. For Organization, set the Organization Collaborator role.

2. Copy your generated API token.

2. Connector Configuration

1. Open Nucleus and go to Integration Hub > Connector Setup.

2. Under the Scanners section, click the Snyk icon.

3. In the Setup Snyk Connector popup, complete the following fields:

4. Click the Save Connection button and wait for the Success message.

5. Click the Test Connection button. You'll see a message to notify you that the connection test was successful. Your connector is now setup properly.

6. Close the popup window.

3. Vulnerability Data Ingestion

1. Go to Integration Hub > Import via Connector.
2. Select the Snyk connector you just created.
3. Select the import method (All, Organization or Target).
   
4. If you selected Organization or Target, select which you would like to import.
5. Select a schedule and click Save & Finish.

Limitations

Snyk Code Finding Instance Uniqueness

The API for Snyk Code has limitations which limits Nucleus' ability to differentiate between similar code vulnerabilities, which results in multiple instances of a vulnerability having the same details.

Snyk Code Description & Recommendation

Whilst findings from Snyk Code do have a unique finding description and recommendation in the UI, these fields are unavailable in the API. Until such time that these fields are available, findings from Snyk Code will show the following for their description and recommendation fields:

We recommend reaching out to your Snyk customer success manager to request that support for retrieving these fields is added to the API.