Findings come inSoftware composition & code
Snyk
Pulls Snyk's open-source, code and container issues into the same finding table as everything else, so a vulnerable dependency competes for attention with a firewall hole rather than living in its own tab.
What the connector does
- Issues from every project in the organisations you name
- Normalised to OCSF vulnerability_finding with the CVE, the CWE and the affected package version
- Deduplicated against findings the same package produces in other tools
- Re-synced on a schedule; an issue Snyk stops reporting is a closure candidate, not a silent disappearance
Credential required
A Snyk API token with read access to the organisations you name. No write scope is used.
What this connector is for
Snyk knows which of your dependencies have known vulnerabilities. It does not know that the service those dependencies ship in is internet-facing, that the CVE is on CISA's exploited list, or that your container scanner has flagged the same package in a different image. That correlation is what this platform does, and this connector is how Snyk's half of it arrives.
What is ingested
Every open issue on every project in the organisations the connector is configured for: the package, the version, the introduced-through path, the CVE where there is one, and Snyk's own severity. The severity is kept as the source's opinion and is not what drives prioritisation — EPSS, KEV membership, asset criticality and internet exposure do that, and Snyk cannot see any of them.
What happens next
The issue becomes a finding against the repository or image it belongs to. If the same package vulnerability arrives from another source — a container scan, a code scan, an infrastructure scanner — the platform merges them into one finding with several sources rather than three tickets for one upgrade. Routing sends it to the team that owns the repository, and the finding closes when a later sync no longer reports it.
What you have to grant
A read-only API token. This connector never writes to Snyk: it does not ignore issues, change severities or open pull requests there. If a fix is drafted, it is drafted against your source repository through a separate credential you grant separately.