Snyk

Configure the Snyk integration to ingest SAST and SCA vulnerability findings into Cortex Cloud, unifying your software package assets and security code.

The Snyk integration connects Cortex Cloud to your Snyk organization, enabling automatic ingestion of security findings from Snyk-scanned repositories. The integration supports two scan types that can be enabled independently or together:

• SCA (Software Composition Analysis): Ingests open-source dependency vulnerabilities, producing software package assets and CVE-based vulnerability findings
• SAST (Static Application Security Testing): Ingests code-level security vulnerabilities, producing findings with precise source code locations, CWE classifications, and commit attribution

Important

Snyk Free tier is not supported. A paid Snyk plan (Team, Business, or Enterprise) is required to ingest findings from Snyk.

Prerequisites

• Cortex Cloud permissions and requirements:

  • Ensure you have View/Edit permissions for Data Sources and Integrations (RBAC: AppSec Admin or Instance Administrator)
  • Ensure that you have a connected version control system (VCS) and repositories
• Snyk permissions and requirements:

  • Permissions: The Snyk API token must have direct organization-level access. The token must have explicit access to the specific Snyk organization being integrated. Group-level permissions alone are not sufficient because Snyk’s REST API requires explicit authorization at the individual Organization level to access scoped endpoints
  • Organization-level access: Assign the Org Collaborator role to the specific organization
  • Recommended account type: Generate and save the API token from a Service Account. Service accounts are decoupled from individual users, ensuring the integration remains uninterrupted even if an employee leaves the organization or changes roles
  • Access control: These roles authorize Cortex Cloud to list applications and retrieve findings without granting excessive administrative privileges

Supported Snyk API endpoints

Region	API Hostname
US (default)	api.snyk.io
US (legacy)	api.us.snyk.io
EU	api.eu.snyk.io
AU	api.au.snyk.io

Manage integration instances

Manage administration channels, credential rotation, and integration deletion in Third-party integrations lifecycle administration and automation.

Manage ingested findings

Investigate findings, prioritize issues, remediate risks, and enforce policies in Manage the third-party data lifecycle.

Next step

• Configure Snyk ingestion