Copy page

Application Security

Snyk Issue Findings

Collects security vulnerabilities and other risks identified by Snyk across your codebase, dependencies, and container images.

Sync Type: Incremental

Requirements

• You can follow the steps outlined in Snyk's documentation to create a Snyk service account.
• The role you will select depends on which Snyk level you are connecting at:
• If connecting at the Snyk group level, select the Group Admin role.
• If connecting at the Snyk organization level, select the Org Admin role.
• For the name of the account, we recommend Monad Service.
• Once you have successfully created the service account, be sure to copy the token that Snyk generates. Make sure to save this token to your secrets tool or password manager before you navigate away from the page, since it will not be displayed again.

Details

Monad uses the updated_after and updated_before filters on the API to fetch issues per organization in 30-day windows. After each successful sync, Monad resumes from the latest issue updated_at it has collected for that organization. If this is the first sync, Monad starts from the Backfill Start Time.

Note: A sync is performed every minute. To avoid missing issues that Snyk makes visible shortly after they are updated, each sync only collects issues updated more than 5 minutes ago. Newer issues are picked up by a later sync, so they arrive up to about 5 minutes later than they are updated in Snyk.

Configuration

The following configuration defines the input parameters. Each field's specifications, such as type, requirements, and descriptions, are detailed below.

Settings

Setting	Type	Required	Description
Backfill Start Time	string	No	The date to start fetching data from. If not specified, no past records will be fetched.
API Rate Limit	object	No	Optional limit on the connector's outbound request rate to the source API. Leave blank to use the connector's default behavior. See API Rate Limiting for the field format, limits, and how to choose a value.

Secrets

Secret	Type	Required	Description
API Key	string	Yes	API Key for the Synk API. This is required to authenticate requests.

Related Articles

• https://docs.snyk.io/snyk-admin/structure-account-for-high-application-performance/service-accounts
• https://docs.snyk.io/snyk-api/reference/issues

Sample Record

Code
{
  "attributes": {
    "coordinates": [
      {
        "remedies": [
          {
            "description": "Upgrade the package version to 6,6.4 to fix this vulnerability",
            "details": {
              "upgrade_package": "5.4,5.4"
            },
            "type": "indeterminate"
          }
        ],
        "representation": [
          "6"
        ]
      }
    ],
    "created_at": "2025-08-11T23:46:48.143061Z",
    "description": "## Overview\n\n\nAffected versions of this package are vulnerable to XML External Entity (XXE) Injection.",
    "effective_severity_level": "info",
    "key": "SNYK-JAVA-COMFASTERXMLWOODSTOX-654321",
    "problems": [
      {
        "disclosed_at": "2025-08-11T23:46:48.143158Z",
        "discovered_at": "2025-08-11T23:46:48.14316Z",
        "id": "CWE-61",
        "source": "CVE",
        "updated_at": "2025-08-11T23:46:48.143179Z",
        "url": "example.net"
      }
    ],
    "severities": [
      {
        "level": "low",
        "score": 7.8,
        "source": "Snyk",
        "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
      }
    ],
    "slots": {
      "disclosure_time": "2025-08-11T23:46:48.143226Z",
      "exploit": "Not Defined",
      "publication_time": "2025-08-11T23:46:48.143242Z",
      "references": [
        {
          "title": "text",
          "url": "info"
        }
      ]
    },
    "title": "XML External Entity (XXE) Injection",
    "type": "package_vulnerability",
    "updated_at": "2025-08-11T23:46:48.143272Z"
  },
  "id": "SNYK-JAVA-COMFASTERXMLWOODSTOX-2928754",
  "type": "issue"
}

Sync frequency

This input polls on a connector-specific interval. A cron schedule configured on the pipeline overrides this cadence. See Input Sync Frequency for details.

Community transforms

The Monad Transforms Repository has ready-made transforms for this input. Import one into your organization, then add it to a pipeline after this input.

Format	Transform
OCSF v1.9.0	Snyk Issue Findings to OCSF v1.9.0
ECS v9.5.0	Snyk Issue Findings to ECS v9.5.0
CEF	Snyk Issue Findings to CEF

Older OCSF versions (v1.1.0) are also in the repository. CEF transforms emit an intermediate record; add the CEF Serializer transform after one to produce the CEF:0 string.