Snyk Integration with DefectDojo

Snyk Integration with DefectDojo

Snyk is a developer security platform from Snyk Ltd. Its products include Snyk Open Source for vulnerable dependencies, Snyk Container for image packages, and Snyk Code for static analysis of first-party code, all available from the Snyk CLI, IDE plugins, source control integrations, and the Snyk web app. For dependency results, snyk test --json produces a JSON report listing each vulnerable package, the dependency path that pulled it in, and the upgrade that fixes it. DefectDojo imports that JSON, and Snyk Code SARIF output through a companion parser.

Snyk Integration with DefectDojo

Our developers already run Snyk in their pull requests, and DefectDojo is where we turn those results into a program. Each vulnerable package from a Snyk report becomes a Finding on the Asset that owns the repository, tagged with the manifest it came from and carrying Snyk's upgrade guidance. Deduplication keeps repeated builds from piling up copies, reimport closes what an upgrade fixed, and Snyk findings land under the same SLAs and reports as our pentest and DAST results. In DefectDojo Pro, the Snyk connector pulls results from the Snyk API so we don't have to ship files around.

Why Snyk Matters

Many dependency vulnerabilities arrive transitively, several levels below the packages a developer chose.

• Snyk reports the full dependency path for each vulnerable package, which tells a developer which direct dependency to upgrade.
• Its remediation data names the upgrade that clears the issue, including other packages that move with it.
• It covers a wide set of package managers, plus container images through snyk container test.
• Results include CVE and CWE identifiers, CVSS data, and, where Snyk provides them, EPSS scores.
• Snyk shows results per project. Security teams responsible for many projects still need one place to see aging, ownership, and SLA status across all of them.

Advantages of This Integration

What we gained by routing Snyk through DefectDojo:

• Version-aware deduplication. DefectDojo hashes Snyk Scan findings on the Snyk vulnerability ID, the dependency path (with versions stripped), component name, and component version, so the same issue through the same path is recognized across builds.
• Reimport lifecycle. Reimporting the next snyk test run into the same Test mitigates findings for packages that were upgraded and reactivates any that return.
• Upgrade guidance on the Finding. The parser pulls Snyk's remediation text into Mitigation and adds upgrade paths and the target manifest, plus target_file: and upgrade_to: tags you can filter on.
• Prioritization data. CVSS v3 vectors, CVE IDs, CWE IDs, and EPSS score and percentile are stored on each Finding, so triage can sort by more than severity.
• Pro connector. DefectDojo Pro's Snyk connector uses the Snyk REST API, so findings sync on a schedule without pipeline changes.

How This Integration Works

The main scan type is Snyk Scan, for Snyk Open Source and Snyk Container JSON. Related scan types cover other Snyk outputs: Snyk Code Scan for snyk code test --sarif output (and the Snyk Scan parser hands SARIF files to it automatically), and Snyk Issue API Scan for JSON returned by the Snyk Issues REST API.

1. Produce a JSON report with the Snyk CLI:

snyk test --json > snyk.json

For a repository with several manifests, use snyk test --all-projects --json > snyk.json; the parser accepts the resulting array of projects. Container results from snyk container test <image> --json use the same scan type.

2. Import the file. In the UI, open the Engagement, choose Import Scan Results, select Snyk Scan, and upload the JSON. To automate it, use the API in Community Edition or DefectDojo Pro:

curl "https://YOUR_INSTANCE/api/v2/import-scan/" \
  -H "Authorization: Token $DD_API_TOKEN" \
  -F "scan_type=Snyk Scan" \
  -F "file=@snyk.json" \
  -F "product_name=orders-api" \
  -F "engagement_name=CI" \
  -F "auto_create_context=true"

DefectDojo Pro users can run the same import with Universal Importer:

universal-importer import \
  --defectdojo-url "https://YOUR_INSTANCE.cloud.defectdojo.com/" \
  --scan-type "Snyk Scan" \
  --report-path "./snyk.json" \
  --product-name "orders-api" \
  --engagement-name "CI" \
  --auto-create-context

3. Or use the Snyk connector (DefectDojo Pro). Enter https://api.snyk.io/rest (or https://api.eu.snyk.io/rest for an EU deployment) in the Location field and a Snyk API token in the Secret field. DefectDojo discovers your Snyk data, creates Records that you map to Assets (or that Auto-Map creates for you), and syncs findings on a schedule.

Data Granularity: What Gets Imported

The table describes the Snyk Scan file parser.

Use Cases

In a CI/CD pipeline: Every merge to main runs snyk test --json and reimports the file into a Test for that repository. A release gate queries DefectDojo for new Critical findings, while older ones that are risk-accepted stay out of the way.

For a monorepo: One --all-projects run covers several manifests. The target_file: tag on each Finding lets each sub-team filter to the manifest it owns.

With DefectDojo Pro across many Snyk organizations: Teams that already have hundreds of Snyk projects use the connector, map Records to Assets, and get findings flowing without touching pipelines.

Combining SCA and SAST: Snyk Open Source results through Snyk Scan and Snyk Code results through Snyk Code Scan sit on the same Asset, alongside other tools, so application risk is reported in one place.

Operational Tips

• Expect DefectDojo severity to differ from the Snyk UI at times. When a CVSS score is present, the parser bands it NVD-style rather than using Snyk's own severity label.
• Use one Test per repository, or per manifest for large repos, and reimport into it. Imports into new Tests each time lose the clean open-to-mitigated history.
• Importing the same Snyk results into several Assets will count the vulnerability in each. Decide on a project-to-Asset mapping before you scale up.
• Filter on upgrade_to: tags to group findings that one upgrade will clear, and assign that as one piece of work.
• Set minimum_severity on import if Low findings would bury the team, and review EPSS percentile during triage for the rest.
• Keep SARIF from snyk code test on the Snyk Code Scan type so code findings get their own dedupe settings (vulnerability ID from tool and file path).