Snyk for ServiceNow Application Vulnerability Response gives application security teams a single view for all their open source, code vulnerabilities, and misconfigurations from development to production. Teams can now simplify coordination with development teams and better manage risks and issue prioritization with a single view, as well as create automated processes for workflow tracking, and process exceptions.
Snyk Open Source automatically detects vulnerabilities and automates fixes during development. With 70-90 percent of modern software applications containing open source software, it’s important to understand and track any security risk this introduces.
Snyk Code analyzes source code directly with unparalleled speed and accuracy at 2.8x the speed of legacy SAST solutions. In addition to providing developers visibility into security flaws in their code, Snyk Code provides actionability and dramatically reduces vulnerability backlogs and time to fix by providing fixes in-line with code in their IDE, CLI, and pull request workflows.
Snyk Infrastructure as Code (IaC) helps security teams identify and fix misconfigurations in their cloud and infrastructure deployments. It integrates seamlessly into the development workflow, so security is built into the code, rather than just the infrastructure. Actionable remediation guidance helps security teams guide developers to resolve misconfigurations quickly.
-
Deliver Snyk security insights on vulnerabilities in open source and code vulnerabilities seamlessly into a ServiceNow workflow
-
Provide visibility into your development team’s application security risk in both platforms
-
Enable AppSec managers to create automated workflow processes to minimize risk and guide developer teams to focus on the highest priorities
- Calculate vulnerability risk and determine prioritization using ServiceNow’s vulnerability calculators combined with Snyk’s industry-leading intelligence
-
Synchronize vulnerability exceptions between ServiceNow and Snyk
-
Consolidate vulnerabilities and security outcomes, giving security teams visibility into end-to-end workflow management
-
Data loss prevention in REST based integrations for New Project Arrival and Vulnerability Filtering changes.
-
Added filtering at project level
-
Project Import Query (renamed from Projects Query) - filter imported projects on environment, tags, origin, organization, target name, lifecycle, type, branch, Snyk creation date, status, last scan date and name
-
Project API Query - narrows the projects retrieved at the Snyk API level before import; validated on save against the supported API parameter names
-
Added readonly role for Snyk (x_snyk2_snyk_vr_in.snyk_user), with module, dashboard and report access
-
Added support for configurable data flow direction, allowing users to choose between bidirectional (Snyk to and from ServiceNow) and unidirectional inbound only (Snyk to ServiceNow)
-
Added support to track project eligibility and backfill history
-
Is Eligible and Eligibility Query on Snyk Projects record why a project was or was not imported
-
Needs Full Issue Sync flags projects created in Snyk before the last successful run for a full historical issue fetch (SCA/IaC, SAST or both)
-
Removed ondemand API call for project fetching in issues integration
-
Added AVIT debug logging property (x_snyk2_snyk_vr_in.enableAvitDebugLogging, default false) that logs every skipped or ignored AVIT with the reason
-
Updated mapping as below
-
Sn_vul_app_vulnerable_item
-
Affected_functionality - Determined from Issue’s coordinates.
-
project_name = key_asset
-
priority - no longer populated with the Snyk risk score; the score already maps to the Snyk Priority Score field
-
Sn_vul_app_vul_entry
-
Mapped 27 CVSS-related fields in the Application Vulnerability Entry for SCA REST (12 CVSS 3.0/3.1 fields, 15 CVSS 4.0 fields)
-
cvss_base_score and cvss_vector - prefer CVSS 4.0, fall back to 3.1 then 3.0
-
cisa_exists - derived from exploit maturity "Attacked" (CVSS 4.0 exclusive), Snyk's closest signal to the CISA KEV catalogue
-
source_severity = Snyk effective severity level
-
Renamed fields for clarity (labels only, column names unchanged, existing reports and filters continue to work)
-
Created to Snyk Creation Date on Snyk Projects
-
Is Deleted to Not Imported on Snyk Projects
-
Projects Query to Project Import Query on Vulnerability Filtering
-
Reorganised the Vulnerability Filtering form so related filters are grouped, with annotations explaining each group
Bug fixes:
-
Resolved transformation errors raised during import due to empty response
-
Resolved bug of correct CIs are attaching after sometime when project was dynamically created at the time of issues fetching
-
Corrected the counts of ignored and skipped issues reported at the end of a run
-
Resolved issue of AVIT are getting opened in ServiceNow when already resolved on Snyk for V1 APIs
Upgrade notes
-
If upgrading from 3.2.* or lower version to 3.4.0 directly than validate upgrade history and revert to base system for data source skipped files, Details are given in section 5.4.
-
Run the Remove corrupted Priority from Snyk AVIT fix script once after upgrading to clear incorrect Priority values on existing AVIT records
Vulnerability Response should be installed
Other Requirements:
Requires Snyk Enterprise plan