Skip to content

[snyk]: Fingerprint should include the status #14356

@clement-fouque

Description

@clement-fouque

Integration Name

Snyk [snyk]

Dataset Name

snyk.issues

Integration Version

2.0.0

Agent Version

9.0.1

Agent Output Type

elasticsearch

Elasticsearch Version

9.0.1

OS Version and Architecture

Docker image (elastic-package)

Software/API Version

Snyk SaaS

Error Message

No error message

Event Original

No event original

What did you do?

I ingested Snyk issues into the stack. Based on the way the fingerprint is set up, there should be

What did you see?

- fingerprint:
fields:
- snyk.issues.id
target_field: _id

What did you expect to see?

Add a field (like the vulnerability status) as part of the fingerprint. We should probably add snyk.issues.attributes.status and snyk.issues.attributes.ignored.

Anything else?

This was never tested/confirmed. It's based of my analysis of the integration and a review from @SpencerLN and @christophercutajar. As the GitHub Secret Scanning contains multiple fields, it confirms our analysis.

- fingerprint:
fields:
- github.secret_scanning.number
- github.secret_scanning.updated_at
- github.secret_scanning.resolved_at
target_field: "_id"
ignore_missing: true

Metadata

Metadata

Assignees

Type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions