Copy page

Upwind

Vulnerability Findings

Retrieves a full snapshot of vulnerability findings (CVEs) detected by Upwind across container images, packages, and cloud resources.

Sync Type: Full Synchronization

Prerequisites

Before connecting Monad to Upwind, you need:

1. An active Upwind account with API access enabled
2. An Upwind API application with OAuth2 Client Credentials (Client ID and Client Secret)
3. Your Upwind organization ID (format: org_<alphanumeric>), found in the Upwind console under Organization Settings

Authentication

Upwind uses the OAuth2 client credentials grant. Monad exchanges the Client ID and Client Secret for a short-lived access token at https://auth.upwind.io/oauth/token before each request. Token refresh is handled automatically.

Generating API Credentials

1. Log in to the Upwind console.
2. Navigate to Settings > Credentials.
3. Click Generate Credentials.
4. Select API as the credential type.
5. Define the Scope: choose Global Scope for full read access, or Custom and grant read access to vulnerability findings.
6. Provide a descriptive name (e.g., monad-vulnerability-findings).
7. Click Generate New Credentials.
8. Copy the Client ID and Client Secret — the secret is shown only once, so store it securely.

Finding your Organization ID

1. In the Upwind console, open Organization Settings.
2. Copy the Organization ID value. It begins with org_ followed by alphanumeric characters.

Configuration

The following table describes all settings and secrets used to configure this input.

Settings

Setting	Type	Required	Description
Region	string	Yes	The Upwind deployment region. Determines which API and authentication endpoints are used. One of: United States, Europe, Middle East. Defaults to United States.
Organization ID	string	Yes	Your Upwind organization identifier. Found in the Upwind console under Organization Settings. Format: org_<alphanumeric>.
Severity Filter	array of strings	No	Restrict returned findings to the specified CVSS severity levels. Leave empty to receive all severities. Allowed values: critical, high, medium, low, unclassified, other.
Cron	string	Yes	Cron expression defining the polling interval (5-field, standard syntax). For example, 0 0 * * * runs daily at midnight.

Secrets

Secret	Type	Required	Description
Client ID	string	Yes	OAuth2 Client ID from your Upwind API application. Used to obtain access tokens via the client credentials grant.
Client Secret	string	Yes	OAuth2 Client Secret from your Upwind API application. Used alongside the Client ID to obtain access tokens.

Setup Walk-through

1. In the Monad UI, navigate to Inputs and click Add Input
2. Search for and select Upwind — Vulnerability Findings
3. Select the Region that matches your Upwind deployment (United States, Europe, or Middle East)
4. Enter your Organization ID (e.g., org_xxxxxxxx)
5. Optionally, select one or more Severity Filter values to limit which findings are ingested
6. Enter your Cron schedule for how often Monad should fetch a full snapshot (e.g., 0 0 * * * for daily)
7. Enter the Client ID and Client Secret from your Upwind API application
8. Click Save to create the input

On each scheduled run, Monad fetches all vulnerability findings for the configured organization, paging through results using the RFC 5988 Link response header until no further pages are available.

Troubleshooting

Common Issues

1. Authentication Failures (401 Unauthorized)

   • Verify the Client ID and Client Secret are correct and match the API application in your Upwind console
   • Ensure the OAuth2 client has not been deleted or rotated
   • Check that the Client Secret has no extra whitespace

2. Organization Not Found (403 / 404)

   • Confirm the Organization ID starts with org_ and matches exactly what appears in your Upwind Organization Settings
   • Verify the API application has permissions to read data for the specified organization

3. Wrong Region

   • If you see connection errors or empty results, confirm you have selected the region where your Upwind account is hosted
   • United States: api.upwind.io, Europe: api.eu.upwind.io, Middle East: api.me.upwind.io

4. No Findings Returned

   • Check whether a Severity Filter has been configured that may be excluding all current findings
   • Remove the severity filter and run again to confirm the connection is working

5. Partial Data on Large Organizations

   • The connector performs a full re-scan on every cron tick; consider scheduling runs during off-peak hours for large finding sets
   • Increase the cron interval (e.g., weekly) if the volume of findings causes slow ingestion

Related Articles

• Upwind Documentation
• Upwind API Reference