Snyk step configuration

Scan code repositories and container images with Snyk.

The Snyk step in Harness STO enables you to perform Snyk Code, Open Source, Container, and IaC scanning in both Orchestration and Ingestion modes of STO. This document will guide you through understanding the fields, configuring them, and providing any necessary information for setting up the step.

• You can utilize custom STO scan images and pipelines to run scans as a non-root user. For more details, refer Configure your pipeline to use STO images from private registry.

• STO supports three different approaches for loading self-signed certificates. For more information, refer Run STO scans with custom SSL certificates.

Snyk step settings

It is recommended to add a Snyk step to the Security or Build stage and configure it as described below.

Scan

Scan Mode

Scan Configuration

Target

Type

Target and variant detection

Name

Variant

Workspace (repository)

Container image

Type

Domain

Name

Tag/Digest

Authentication

Access Token (Orchestration scans)

Scan Tool

Use Raw Scanner Severity

Ingestion File

Log Level

Additional CLI flags

Use this field to run the Snyk scanner with additional flags such as:

--all-projects --detection-depth=3

With these flags, the Snyk step scans recursively down the repository tree to a depth of 3 folders.

• Passing CLI flags is an advanced feature. Some flags might not work in the context of STO. You should test your flags and arguments thoroughly before you use them in your production environment.

• STO does not support context-specific arguments or arguments that appear at the end of the command line, such as Maven or Gradle arguments.

Fail on Severity

Settings

Additional Configuration

Advanced settings

Show original issue severities overridden by Snyk security policies

Harness originally will categorize a scan utilizing the CVSS scores that are provided, and using it to categorize vulnerabilities into Critical, High, Medium, and Low categories

With the Snyk Step, or a Custom Scan Step utilizing a self installed Snyk runner, you can configure Harness to utilize the severity scores in a Snyk Enterprise security policy, and provide an override severity for an issue. This can be adjusted from your Snyk results, or it can also come from the snyk CLI. You can see this information in Issue Details.

Harness will also display the information that the severity was overridden, and the original score, so long as the report follows the Snyk required format

This feature is supported for snyk container and snyk test JSON output that properly reflects an override.

Requirement

• STO Plugin version 1.56.x or higher

JSON Output Format

Please note that the override format must follow the Snyk documented process, such as in the following Snyk example.

The formatting should contain the following:

• A value, originalSeverity, needs to be defined, and should contain the original severity value

• The severity value can now be defined with the new severity value. Below is a portion of an adjusted vulnerability sample:

{  
     "vulnerabilities": [
        {
            "id": "SNYK-JS-POSTCSS-5926692",
            "title": "Improper Input Validation",
            "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "credit": [
                "Unknown"
            ],
            "semver": {
                "vulnerable": [
                    "<8.4.31"
                ]
            },
            "exploit": "Not Defined",
            "fixedIn": [
                "8.4.31"
            ],
            "patches": [],
            "insights": {
                "triageAdvice": null
            },
            "language": "js",
            "severity": "critical",
            "originalSeverity": "medium",
            "cvssScore": 5.3,
            "functions": [],
            "malicious": false,
            "isDisputed": false,
            "moduleName": "postcss",
            [...]
        }
    ]
 }

Proxy settings