By connecting your dynamic and static scan results, you can streamline triage and remediation. This integration links DAST findings directly to the vulnerable location in your source code, helping your developers fix issues faster.
Prerequisites
You must have active accounts in both Snyk API & Web and the Snyk platform.
You need to have a target application that is being scanned by both Snyk for SAST (Snyk Code) and Snyk API & Web for DAST.
Step 1: Connect your Snyk accounts
First, you need to establish a connection between your Snyk API & Web account and your main Snyk account.
In Snyk API & Web, navigate to Settings > Integrations.
Locate the Snyk module.
Follow the link to Snyk group. This starts the authentication / authorization process to connect your two accounts.
Step 2: Map a target to your Snyk projects
Next, you need to tell Snyk API & Web which Snyk Code projects (code repository) correspond to your DAST target.
Navigate to the Targets page and identify the target you want to integrate.
Go to that target Settings and click the Integrations tab.
In the Snyk module, click the Select projects button to open a new modal.
Map the current Snyk API & Web target to the corresponding code analysis project(s) from Snyk and Save.
Step 3: Run a DAST scan
Run a new scan on the target you configured in Step 2. Snyk API & Web now correlates the DAST findings from this scan with the SAST findings from your mapped Snyk projects.
Step 4: Analyze Correlated Findings
After the scan is complete, you can view the correlated results. Any correlated finding will have a SAST label associated with it.
From the list of findings for your target, click a finding to open its details page.
Select the SAST Findings tab.
Verify the outcome
The SAST Findings tab provides the connection between your DAST and SAST results.
A DAST finding provides proof that a vulnerability is exploitable. This integration links that finding directly to the specific line in your source code, so you can fix it immediately. The correlation will provide you with a link to the vulnerability within Snyk Code, a link to the repository, and a snippet of code that is triggering a given vulnerability.
Manage the feature and provide feedback
You can provide feedback directly on the finding details page.
In the SAST Findings tab, you can report whether you believe the correlation was a match or a mismatch. This will help us fine tune our correlation process and provide even better results.
You can also provide additional qualitative feedback to help us improve the accuracy of the correlation engine.