# Vulnerability Findings

Retrieves a full snapshot of vulnerability findings (CVEs) detected by Upwind across container images, packages, and cloud resources.

**Sync Type: Full Synchronization**

## Prerequisites

Before connecting Monad to Upwind, you need:

1. An active Upwind account with API access enabled
2. An Upwind API application with OAuth2 Client Credentials (Client ID and Client Secret)
3. Your Upwind organization ID (format: `org_<alphanumeric>`), found in the Upwind console under **Organization Settings**

## Authentication

Upwind uses the **OAuth2 client credentials** grant. Monad exchanges the Client ID and Client Secret for a short-lived access token at `https://auth.upwind.io/oauth/token` before each request. Token refresh is handled automatically.

### Generating API Credentials

1. Log in to the [Upwind console](https://console.upwind.io).
2. Navigate to **Settings** > **Credentials**.
3. Click **Generate Credentials**.
4. Select **API** as the credential type.
5. Define the **Scope**: choose **Global Scope** for full read access, or **Custom** and grant read access to vulnerability findings.
6. Provide a descriptive name (e.g., `monad-vulnerability-findings`).
7. Click **Generate New Credentials**.
8. Copy the **Client ID** and **Client Secret** — the secret is shown only once, so store it securely.

### Finding your Organization ID

1. In the Upwind console, open **Organization Settings**.
2. Copy the **Organization ID** value. It begins with `org_` followed by alphanumeric characters.

## Configuration

The following table describes all settings and secrets used to configure this input.

### Settings

| Setting | Type | Required | Description |
| ------- | ---- | -------- | ----------- |
| Region | string | Yes | The Upwind deployment region. Determines which API and authentication endpoints are used. One of: `United States`, `Europe`, `Middle East`. Defaults to `United States`. |
| Organization ID | string | Yes | Your Upwind organization identifier. Found in the Upwind console under Organization Settings. Format: `org_<alphanumeric>`. |
| Severity Filter | array of strings | No | Restrict returned findings to the specified CVSS severity levels. Leave empty to receive all severities. Allowed values: `critical`, `high`, `medium`, `low`, `unclassified`, `other`. |
| Cron | string | Yes | Cron expression defining the polling interval (5-field, standard syntax). For example, `0 0 * * *` runs daily at midnight. |

### Secrets

| Secret | Type | Required | Description |
| ------ | ---- | -------- | ----------- |
| Client ID | string | Yes | OAuth2 Client ID from your Upwind API application. Used to obtain access tokens via the client credentials grant. |
| Client Secret | string | Yes | OAuth2 Client Secret from your Upwind API application. Used alongside the Client ID to obtain access tokens. |

## Setup Walk-through

1. In the Monad UI, navigate to **Inputs** and click **Add Input**
2. Search for and select **Upwind — Vulnerability Findings**
3. Select the **Region** that matches your Upwind deployment (United States, Europe, or Middle East)
4. Enter your **Organization ID** (e.g., `org_xxxxxxxx`)
5. Optionally, select one or more **Severity Filter** values to limit which findings are ingested
6. Enter your **Cron** schedule for how often Monad should fetch a full snapshot (e.g., `0 0 * * *` for daily)
7. Enter the **Client ID** and **Client Secret** from your Upwind API application
8. Click **Save** to create the input

On each scheduled run, Monad fetches all vulnerability findings for the configured organization, paging through results using the RFC 5988 `Link` response header until no further pages are available.

## Troubleshooting

### Common Issues

1. **Authentication Failures (401 Unauthorized)**
   - Verify the Client ID and Client Secret are correct and match the API application in your Upwind console
   - Ensure the OAuth2 client has not been deleted or rotated
   - Check that the Client Secret has no extra whitespace

2. **Organization Not Found (403 / 404)**
   - Confirm the Organization ID starts with `org_` and matches exactly what appears in your Upwind Organization Settings
   - Verify the API application has permissions to read data for the specified organization

3. **Wrong Region**
   - If you see connection errors or empty results, confirm you have selected the region where your Upwind account is hosted
   - United States: `api.upwind.io`, Europe: `api.eu.upwind.io`, Middle East: `api.me.upwind.io`

4. **No Findings Returned**
   - Check whether a **Severity Filter** has been configured that may be excluding all current findings
   - Remove the severity filter and run again to confirm the connection is working

5. **Partial Data on Large Organizations**
   - The connector performs a full re-scan on every cron tick; consider scheduling runs during off-peak hours for large finding sets
   - Increase the cron interval (e.g., weekly) if the volume of findings causes slow ingestion

## Related Articles

- [Upwind Documentation](https://docs.upwind.io)
- [Upwind API Reference](https://docs.upwind.io/restapi/v1/introduction)