Snyk importer (API format)

[ptitkosmos]

Scanner Name
Snyk (from API)

Sample File
(SCA only) https://snyk.docs.apiary.io/#reference/projects/aggregated-project-issues/list-all-aggregated-issues.
https://apidocs.snyk.io/?version=2024-10-15#get-/orgs/-org_id-/issues

Additional info
The current importers use cli generated files from snyk code test and snyk test commands. For some reasons, I cannot use the cli and the other way to query issues is by API, which format is way different. It would be nice to have an importer from a file (json) containing the same structure than the API response. The API is in V1 that will be deprecated when it will be migrated to the new REST API. No estimation given by Snyk teams.

[L364CY64]

@ptitkosmos Did you manage to use Snky API to the Dojo? I have the same requirement.

[L364CY64]

The problem is the Snyk API(either V1 or REST) didn't offer the endpoint to query the issues by project, you can only get the whole ORG issues or latest issues, WEIRD design lol.

[ptitkosmos]

Hello,

Yes, I use the api Org issues with scan_type set to project and scan_item with the project id. Then, depending the type, I parse the result to match the format wanted by DefectDojo. It is pretty good for SCA issues but awful for SAST ones... At least, I have the information there are issues in Snyk for my products.

[L364CY64]

Hi @ptitkosmos thanks for answering.

May I know you were directly import the issue to the Dojo through their finding api OR pasring result from Snyk Org issue API to the Snyk CLI --json format and upload the whole file to the import finding(from a file) endpoint in Dojo...

I would say the second one is more powerful, but I am not sure we can do that. Not yet try the org issues api with the scan_type para... anyway thanks a lot for answering me and your time.

[ptitkosmos]

Hello @L364CY64,

the parsed result is a json file that I upload thanks to DefectDojo Api reimport scan endpoint (/api/v2/reimport-scan/). The file format depends on the project type and is matching the fields used in the related parser (e.g. https://github.com/DefectDojo/django-DefectDojo/blob/master/dojo/tools/snyk/parser.py and https://github.com/DefectDojo/django-DefectDojo/blob/master/dojo/tools/snyk_code/parser.py).

[L364CY64]

@ptitkosmos That's really helpful—thanks! I can now create a parser to use the import function. However, it seems that there’s no fix path data included for SCA vulnerabilities. I’d like to include the fix version in the Dojo record before assigning it to Jira. Is that not possible because the API doesn’t return the fixed version? Just want to confirm if I’m understanding this correctly.

I saw those data is available in the frontend :(

[L364CY64]

@ptitkosmos This is better lol {{baseUrl}}/org/:orgId/project/:projectId/aggregated-issues