.png)
.png)
Snyk prioritizes issues based on exploitability, reachability, and business impact.
Use bulk actions to fix similar issues across Snyk Projects.
| In development | -| Day2Operations | Snyk 2.0 rduces operational friction between finding a vulnerability and acting on it, through grouped navigation, issue deduplication, and bulk triage actions. | In development | +| Day2Operations | Snyk 2.0 reduces operational friction between finding a vulnerability and acting on it, through grouped navigation, issue deduplication, and bulk triage actions. | In development | ## What is Snyk 2.0 trying to solve? diff --git a/discover-snyk/getting-started/snyk-release-process.md b/discover-snyk/getting-started/snyk-release-process.md index 1dc2c29f9b61..45d5f352a190 100644 --- a/discover-snyk/getting-started/snyk-release-process.md +++ b/discover-snyk/getting-started/snyk-release-process.md @@ -40,7 +40,7 @@ Brownouts occur when Snyk temporarily suspends an API endpoint or a feature, mak ### Deprecated features -Deprecated features are outdated and will be removed in the future. The documentation page will announce the transition of a feature to Deprecated six months before its start date. +Deprecated features are outdated and Snyk removes them in the future. The documentation page announces the transition of a feature to Deprecated six months before its start date. * Snyk Code Quality is deprecated. * Snyk Code Local Engine is deprecated. @@ -73,9 +73,9 @@ Deprecated features are outdated and will be removed in the future. The document ### End of support features -When a feature transitions to end-of-support, both development and support work are terminated. +When a feature transitions to end-of-support, Snyk terminates both development and support work. -The documentation page will announce the transition of a feature to End of Support six months before its start date. +The documentation page announces the transition of a feature to End of Support six months before its start date. ### End of Life features diff --git a/discover-snyk/implementation-and-setup/enterprise-implementation-guide/README.md b/discover-snyk/implementation-and-setup/enterprise-implementation-guide/README.md index 9111edba7b52..20acfa3cceaf 100644 --- a/discover-snyk/implementation-and-setup/enterprise-implementation-guide/README.md +++ b/discover-snyk/implementation-and-setup/enterprise-implementation-guide/README.md @@ -1,6 +1,6 @@ # Enterprise implementation guide -Rolling out a developer security platform across a large organization requires a consistent, repeatable approach to account configuration. In this guide, you will learn how to streamline your enterprise rollout in Snyk by creating a dedicated template Organization and altering settings for each individual Organization created from that original template. +Rolling out a developer security platform across a large organization requires a consistent, repeatable approach to account configuration. This guide shows you how to streamline your enterprise rollout in Snyk by creating a dedicated template Organization and altering settings for each individual Organization created from that original template. To have a successful Snyk rollout, you need to: @@ -18,7 +18,7 @@ To have a successful Snyk rollout, you need to: 6. [Initial team rollout](initial-team-rollout.md). 7. [Automate prevention measures](automate-prevention-measures.md). -By the end of this guide, you will have successfully configured a baseline template Org, used it to easily copy your global settings and integrations to provision new Organizations, and learned how to customize individual settings in those new environments to support specific team workflows. +By the end of this guide, you will have configured a baseline template Org, used it to copy your global settings and integrations to provision new Organizations, and learned how to customize individual settings in those new environments to support specific team workflows. {% hint style="info" %} To understand how AI is used at Snyk and how this may affect your implementation decisions, visit [AI Data and Governance](https://app.gitbook.com/o/-M4tdxG8qotLgGZnLpFR/s/ELvljsaLKPkSpffOkmsQ/how-snyk-incorporates-generative-ai-into-the-platform). @@ -102,13 +102,13 @@ Depending on your tech stack and workflows, you can choose from three primary im * Snyk CLI for granular control within your CI/CD pipelines * Snyk API for large-scale programmatic automation -Once you import your Projects, you can apply specific tags and attributes to easily categorize, filter, and generate targeted reports across your entire portfolio. +After you import your Projects, you can apply specific tags and attributes to categorize, filter, and generate targeted reports across your entire portfolio. To learn more, visit [Gain visibility by importing repositories](phase-3-gain-visibility/). ## Initial team rollout -Successfully rolling out Snyk to your development team requires clear communication, targeted education, and seamless workflow integration. +Successfully rolling out Snyk to your development team requires clear communication, targeted education, and smooth workflow integration. Start by using customizable templates to announce the launch, tailoring your messaging and feature rollout to match your team's comfort level with security automation. diff --git a/discover-snyk/implementation-and-setup/enterprise-implementation-guide/automate-prevention-measures.md b/discover-snyk/implementation-and-setup/enterprise-implementation-guide/automate-prevention-measures.md index dee1ebe56ff8..6da7447833db 100644 --- a/discover-snyk/implementation-and-setup/enterprise-implementation-guide/automate-prevention-measures.md +++ b/discover-snyk/implementation-and-setup/enterprise-implementation-guide/automate-prevention-measures.md @@ -1,6 +1,6 @@ # Automate prevention measures -Once you have visibility into your existing security posture, implement prevention and gating systems to stop new vulnerabilities from entering your applications. By automating these checks, you empower developers to take responsibility for the security of their specific changes without manually triaging every issue. +After you have visibility into your existing security posture, implement prevention and gating systems to stop new vulnerabilities from entering your applications. By automating these checks, you empower developers to take responsibility for the security of their specific changes without manually triaging every issue. Implementing prevention measures involves the following key stages: @@ -19,13 +19,13 @@ Implementing prevention measures involves the following key stages: You can prevent new issues using two main functions: -* **PR/MR checks**: Available for Snyk Open Source and Snyk Code. These test code changes are immediately upon submission. +* **PR/MR checks**: Available for Snyk Open Source and Snyk Code. These test code changes immediately upon submission. * **CI/CD pipelines**: Integrate Snyk into your build pipeline to gate Open Source, Code, IaC, and Container vulnerabilities. ## Establish exception processes {% hint style="success" %} -**Key decision**: Define who can override security gates. Clear authority prevents development bottlenecks during urgent releases.: +**Key decision**: Define who can override security gates. Clear authority prevents development bottlenecks during urgent releases. {% endhint %} Ensure teams understand how to address blocked PRs or failed builds: @@ -52,7 +52,7 @@ PR checks prevent issues from entering the codebase. Adding Snyk to your pipeline acts as a gatekeeper: -* **No import is required**: Unlike PR checks, pipeline tests do not require repositories to be imported via SCM integration. +* **No import is required**: Unlike PR checks, pipeline tests do not require repositories to be imported through SCM integration. * **Use CLI tools**: Use `snyk-delta` to identify only the new vulnerabilities introduced in a specific build. ## Secure custom images and IaC diff --git a/discover-snyk/implementation-and-setup/enterprise-implementation-guide/configure-group-settings-and-policies/README.md b/discover-snyk/implementation-and-setup/enterprise-implementation-guide/configure-group-settings-and-policies/README.md index 110bf08c25ee..35dbee06ee25 100644 --- a/discover-snyk/implementation-and-setup/enterprise-implementation-guide/configure-group-settings-and-policies/README.md +++ b/discover-snyk/implementation-and-setup/enterprise-implementation-guide/configure-group-settings-and-policies/README.md @@ -1,6 +1,6 @@ # Configure Group settings and policies -This page is designed to help you plan your Snyk account structure and policies at Group-level to ensure efficient asset management, precise access control, and accurate reporting. +This page helps you plan your Snyk account structure and policies at Group level to ensure efficient asset management, precise access control, and accurate reporting. ## Confirm points of contact @@ -37,7 +37,7 @@ To identify priority applications, categorize them based on: * Define who can provision users and grant Snyk access to external platforms, such as Git repositories. {% endhint %} -Snyk uses a hierarchical structure to manage all assets and security policies. This section will help you map your business to the Snyk architecture. +Snyk uses a hierarchical structure to manage all assets and security policies. This section helps you map your business to the Snyk architecture. * **Understanding the hierarchy:** Learn the purpose of the Tenant, Group, Organization, and Project levels. * **Group structure:** Decide how many top-level Group accounts your company requires. @@ -46,7 +46,7 @@ To learn more, visit [Structure your account](structure-your-account.md). ## Authentication and access: set up SSO -Implement Single Sign-On (SSO) at the Group level before rolling Snyk out to your organization. While pilot teams often start with personal authentication, transitioning to SSO is required for broad adoption, consistent login access, and centralized control. +Implement Single Sign-On (SSO) at the Group level before rolling Snyk out to your organization. While pilot teams often start with personal authentication, you must transition to SSO for broad adoption, consistent login access, and centralized control. Choose a provisioning strategy that defines the user experience and access level for new users. @@ -88,7 +88,7 @@ To learn more, visit [Authentication and access.](authentication-and-access.md) * Decide how to automate the governance, tracking, and remediation workflows for your assets to ensure continuous security visibility and compliance {% endhint %} -Policies allow you to automate business context, compliance checks, and notification workflows. +Policies let you automate business context, compliance checks, and notification workflows. * **License policies:** Decide which specific license types to explicitly allow or disallow to match your specific legal and compliance requirements. * **License severity:** Understand and configure how Snyk assigns High or Medium severity to problematic commercial licenses. diff --git a/discover-snyk/implementation-and-setup/enterprise-implementation-guide/configure-group-settings-and-policies/authentication-and-access.md b/discover-snyk/implementation-and-setup/enterprise-implementation-guide/configure-group-settings-and-policies/authentication-and-access.md index 133e51cc1ee0..98cc1c668626 100644 --- a/discover-snyk/implementation-and-setup/enterprise-implementation-guide/configure-group-settings-and-policies/authentication-and-access.md +++ b/discover-snyk/implementation-and-setup/enterprise-implementation-guide/configure-group-settings-and-policies/authentication-and-access.md @@ -46,7 +46,7 @@ Custom mapping requires Snyk professional services. Contact your account team fo **Key decision**: Determine if you need to pre-allocate users to specific Organizations and roles before their first login to prevent broad default access. {% endhint %} -If you need to define specific permissions before users first log in, use the Snyk API. This allows you to: +If you need to define specific permissions before users first log in, use the Snyk API. This lets you: * Assign a specific role to each user. * Grant access to specific Organizations automatically. @@ -70,7 +70,7 @@ The Tenant is the highest level of the Snyk hierarchy, and it encompasses all Gr * **Tenant Admin:** Can manage users across the entire Tenant, assign roles, and remove members. * **Tenant Viewer:** Provides read-only access to Tenant-level features like Snyk Analytics. -* **Tenant Member**: Allows access to the Tenant level but requires specific Group or Organization permissions to take action. +* **Tenant Member**: Provides access to the Tenant level but requires specific Group or Organization permissions to take action. {% hint style="info" %} Features like Snyk Analytics are available only on Enterprise plans. You can switch between Tenants by selecting the Tenant name in the navigation menu. @@ -89,7 +89,7 @@ Pre-defined roles at these levels have fixed permissions that cannot be modified **Group-level roles** * **Group Admin**: Provides full permissions at the Group and Organization levels. Assign this role to Snyk administrators. -* **Group Member**: Allows access to the Group but requires specific Organization-level permissions to interact with Projects. +* **Group Member**: Provides access to the Group but requires specific Organization-level permissions to interact with Projects. * **Group Viewer**: Provides read-only access to the Group level. Use this to audit Group settings without making changes. {% endstep %} {% endstepper %} diff --git a/discover-snyk/implementation-and-setup/enterprise-implementation-guide/configure-group-settings-and-policies/define-policies.md b/discover-snyk/implementation-and-setup/enterprise-implementation-guide/configure-group-settings-and-policies/define-policies.md index 0bfd5e4a5ec4..4ebbc416d54a 100644 --- a/discover-snyk/implementation-and-setup/enterprise-implementation-guide/configure-group-settings-and-policies/define-policies.md +++ b/discover-snyk/implementation-and-setup/enterprise-implementation-guide/configure-group-settings-and-policies/define-policies.md @@ -1,6 +1,6 @@ # Define policies -Policies define how Snyk behaves when identifying issues. Policies give you a quick and automated way to identify, prioritize, and triage issues. This saves valuable development time and allows developers to take more responsibility and ownership for security, reducing the “noise” level. +Policies define how Snyk behaves when identifying issues. Policies give you an automated way to identify, prioritize, and triage issues. This saves development time and lets developers take more responsibility and ownership for security, reducing the “noise” level. ## Security policies @@ -8,10 +8,10 @@ Policies define how Snyk behaves when identifying issues. Policies give you a qu **Key decision:** Decide which conditions automatically increase or decrease the priority or severity of an issue to match your risk appetite, and which specific issues or types of issues are automatically ignored to reduce "noise" and save development time. {% endhint %} -Group administrators can define security policies, thus providing an automated way to identify certain issues or types of issues, and apply actions like changing the severity or ignoring the issue based on your conditions. +Group administrators can define security policies, providing an automated way to identify certain issues or types of issues, and apply actions like changing the severity or ignoring the issue based on your conditions. * Configure policies to increase priority or decrease it as needed. -* Create ignores where needed +* Create ignores where needed. ## License policies @@ -24,14 +24,14 @@ Group administrators can set license policies to define Snyk behavior for treati By default, Snyk determines the severity of licenses as follows: * **High severity**: licenses that definitely present issues for commercial software. -* **Medium severity**: licenses that have clauses that may be of concern and should be reviewed. +* **Medium severity**: licenses that have clauses that may be of concern and that you should review. Configure policies to match your requirements. ## Asset policies {% hint style="success" %} -**Key decision:** Decide how to automate the governance, tracking, and remediation workflows for your assets to ensure continuous security visibility and compliance +**Key decision:** Decide how to automate the governance, tracking, and remediation workflows for your assets to ensure continuous security visibility and compliance. {% endhint %} Asset policies in Snyk Essentials automate business context and notification workflows. Use policies to identify coverage gaps and manage assets at scale. @@ -42,7 +42,7 @@ Asset policies in Snyk Essentials automate business context and notification wor A policy consists of the following elements: -* Filters: Define criteria (for example tags or asset names) to group specific assets. +* Filters: Define criteria (for example, tags or asset names) to group specific assets. * Actions: Define what happens to filtered assets, for example, assigning a classification or sending a Slack notification. ### Key filter types diff --git a/discover-snyk/implementation-and-setup/enterprise-implementation-guide/create-a-template-organization/README.md b/discover-snyk/implementation-and-setup/enterprise-implementation-guide/create-a-template-organization/README.md index 08cda11c3cb8..34f1f8a16af3 100644 --- a/discover-snyk/implementation-and-setup/enterprise-implementation-guide/create-a-template-organization/README.md +++ b/discover-snyk/implementation-and-setup/enterprise-implementation-guide/create-a-template-organization/README.md @@ -1,6 +1,6 @@ # Create a template Organization -This guide section is designed to help you plan your Snyk account structure at the Organization-level to ensure efficient asset management, precise access control, and accurate reporting. This Organization will be the template you copy to create additional Organizations from which have standards settings for all your Orgs. +This guide section helps you plan your Snyk account structure at the Organization level to ensure efficient asset management, precise access control, and accurate reporting. This Organization is the template you copy to create additional Organizations that have standard settings for all your Orgs. {% embed url="https://res.cloudinary.com/snyk/video/upload/v1775661970/4._Creating_your_Template_Organization_vf1x0b.mp4" %} Create a template Organization video guide @@ -17,7 +17,7 @@ Below is an outline of the key topics and decisions covered in this guide. * Define who can provision users and grant Snyk access to external platforms, such as Git repositories. {% endhint %} -Snyk uses a hierarchical structure to manage all assets and security policies. This section will help you map your business to the Snyk architecture. +Snyk uses a hierarchical structure to manage all assets and security policies. This section helps you map your business to the Snyk architecture. * **Organization structure:** Determine if your Organization structure should be team-based, product-based, or SCM organization-based to best support your policy and access needs. @@ -47,9 +47,9 @@ To learn more, visit [Authentication and access](authentication-and-access.md). * **Architecture and connectivity:** Select your primary SCM platform and identify where your production container registries (for example, Docker Hub, Amazon ECR) reside. Determine if you need to deploy Snyk Broker (using Docker or Kubernetes) to securely bypass firewalls, segment network traffic, or if you require custom proxy/CA configurations. * **Authentication and access management:** Commit to using dedicated, least-privilege service accounts rather than personal tokens (OAuth/PAT) to guarantee stable connections. Decide whether to use broad, centralized Group-level credentials for global asset discovery or require unique tokens at the Organization level. Verify you have the correct administrative roles to manage this inventory. -* **Developer workflow & remediation:** Define your PR check behaviors and automated fix strategies to match specific team workflows. Establish a monitoring frequency that provides adequate security visibility without overwhelming your developers' capacity to remediate. -* **Snyk Code enablement:** Decide whether to roll out Snyk Code globally or phase it in for high-priority teams. It's crucial to enable Snyk Code before importing your first Projects. If managing at a massive scale, plan to use the Snyk API rather than the UI for this step. +* **Developer workflow and remediation:** Define your PR check behaviors and automated fix strategies to match specific team workflows. Establish a monitoring frequency that provides adequate security visibility without overwhelming your developers' capacity to remediate. +* **Snyk Code enablement:** Decide whether to roll out Snyk Code globally or phase it in for high-priority teams. Enable Snyk Code before importing your first Projects. If managing at a massive scale, plan to use the Snyk API rather than the UI for this step. * **Project import strategy:** Choose the import method that provides the best dependency resolution for your specific programming languages to ensure accurate scanning. {% endhint %} -By configuring your core tools, source control integrations, and default security behaviors now, you establish a standardized baseline that can be easily cloned: either manually or using the API, across your entire business. +By configuring your core tools, source control integrations, and default security behaviors now, you establish a standardized baseline that you can clone, either manually or using the API, across your entire business. diff --git a/discover-snyk/implementation-and-setup/enterprise-implementation-guide/create-a-template-organization/authentication-and-access.md b/discover-snyk/implementation-and-setup/enterprise-implementation-guide/create-a-template-organization/authentication-and-access.md index af066be92002..b63f98466dba 100644 --- a/discover-snyk/implementation-and-setup/enterprise-implementation-guide/create-a-template-organization/authentication-and-access.md +++ b/discover-snyk/implementation-and-setup/enterprise-implementation-guide/create-a-template-organization/authentication-and-access.md @@ -12,7 +12,7 @@ Determine if Snyk pre-defined roles meet your requirements or if you must create Pre-defined roles at these levels have fixed permissions that cannot be modified. -* **Organization Admin**: Allows users to add or delete Projects, override Snyk checks, and provision users. Assign this role to Team Leads. +* **Organization Admin**: Lets users add or delete Projects, override Snyk checks, and provision users. Assign this role to Team Leads. * **Organization Collaborator**: Grants standard developer access. Use this for small teams or a developer-first rollout. ## Align roles with your Organization structure diff --git a/discover-snyk/implementation-and-setup/enterprise-implementation-guide/create-a-template-organization/connect-your-development-tools.md b/discover-snyk/implementation-and-setup/enterprise-implementation-guide/create-a-template-organization/connect-your-development-tools.md index 9f76ee15e69d..24c254fff670 100644 --- a/discover-snyk/implementation-and-setup/enterprise-implementation-guide/create-a-template-organization/connect-your-development-tools.md +++ b/discover-snyk/implementation-and-setup/enterprise-implementation-guide/create-a-template-organization/connect-your-development-tools.md @@ -1,8 +1,8 @@ # Connect your development tools -To roll out Snyk efficiently at scale, your first major milestone is configuring a Template Organization. Rather than setting up every new team from scratch, this template acts as your master blueprint. By configuring your core tools, source control integrations, and default security behaviors here first, you establish a standardized baseline that can be easily cloned, either manually or using the API, across your entire business. +To roll out Snyk efficiently at scale, your first major milestone is configuring a Template Organization. Rather than setting up every new team from scratch, this template acts as your master blueprint. By configuring your core tools, source control integrations, and default security behaviors here first, you establish a standardized baseline that you can clone, either manually or using the API, across your entire business. -As you work through this page, you will: +As you work through this page, you complete these tasks: 1. [Configure SCM integrations for Groups.](connect-your-development-tools.md#configure-scm-integrations-for-groups) 2. [Configure SCM integrations for Organizations.](connect-your-development-tools.md#configure-scm-integrations-for-organizations) @@ -26,7 +26,7 @@ The following table outlines the difference between these two implementation lev ### Configure SCM integrations for Groups -Configure your Source Control Manager (SCM) at the Group level to centralize authentication. This allows Snyk to access your repositories across multiple Organizations without requiring individual configuration for each one. +Configure your Source Control Manager (SCM) at the Group level to centralize authentication. This lets Snyk access your repositories across multiple Organizations without requiring individual configuration for each one. {% embed url="https://res.cloudinary.com/snyk/video/upload/v1775661962/3._Group-Level_Repository_Discovery_jvicn7.mp4" %} Group level repository discovery video guide @@ -69,7 +69,7 @@ Your integration approach should match the structure you selected during the pla * **SCM organization-based structure**: If you have 10+ SCM organizations and are using the `snyk-api-import` tool, ensure your Group-level integration has the scope to access all relevant repositories. * **Team-based structure**: Use Group-level authentication to ensure consistency across different developer teams while maintaining isolated Organizations. -* **Product-based structure**: Centralizing at the Group level allows developers to seamlessly access Projects across multiple product Organizations. +* **Product-based structure**: Centralizing at the Group level lets developers access Projects across multiple product Organizations. | Structure type | Integration strategy | | ----------------- | --------------------------------------------------------------------------- | @@ -95,7 +95,7 @@ If you are using multiple SCMs, Snyk recommends using separate Organizations for **Key decision:** Determine if this specific Organization requires a unique access token or a different service account than the one used at the Group level. {% endhint %} -Unlike Group-level setup, Organization-level integrations allow you to: +Unlike Group-level setup, Organization-level integrations let you: * **Isolate access:** Use a unique Personal Access Token (PAT) or OAuth connection that only has access to a specific team's repositories. * **Override Group defaults:** If a specific business unit uses a different SCM instance (for example, a separate GitHub Org or GitLab Group), you can configure it here without affecting the rest of the company. @@ -113,7 +113,7 @@ Set up your Org-level integrations by navigating to your Organization **Integrat When configuring at the Organization level, consider: * **Token segmentation:** You can assign a unique Broker token to an Organization. This is useful if different teams operate in different VPCs or data centers. -* **Granular troubleshooting:** Dedicated tokens allow you to monitor and troubleshoot connectivity issues for a specific team without impacting the entire Group. +* **Granular troubleshooting:** Dedicated tokens let you monitor and troubleshoot connectivity issues for a specific team without impacting the entire Group. {% hint style="info" %} If you are using Azure Repos, Snyk recommends using Universal Broker to avoid Azure limitations on organization mapping. @@ -136,7 +136,7 @@ While the Group integration provides the connection, the Organization level is w | ------------------- | ---------------------------------------------------------------------- | | Access control | Limits repository visibility to only the members of that Organization. | | Snyk Broker mapping | Maps specific SCM instances to specific internal network segments. | -| Customized rollout | Allows for different "prevention" settings (PR checks) per team. | +| Customized rollout | Allows different "prevention" settings (PR checks) per team. | {% endstep %} {% endstepper %} @@ -180,7 +180,7 @@ For Amazon ECR, Snyk recommends using Cross-Account Role authentication for enha **Key decision:** Decide on a monitoring frequency that balances security visibility with your team's remediation capacity. {% endhint %} -Once integrated, Snyk allows you to manage how often images are re-tested: +After integration, Snyk lets you manage how often images are re-tested: * **Continuous monitoring**: Snyk automatically rescans imported images daily to detect new vulnerabilities. * **Avoid duplication**: If you already scan images in your CI/CD pipeline using the Snyk CLI, decide if you also need registry-level monitoring. Registry integration provides a last line of defense for images currently in storage. @@ -199,9 +199,9 @@ As with SCM integrations, ensure email notifications are disabled at the Organiz Snyk strongly recommends integrating your container registry if your organization fits any of the following profiles: -* **Empowering AppSec autonomy**: This solution enables Application Security (AppSec) teams to manage and scan container images independently. It allows security teams to maintain oversight without bottlenecking developers or requiring them to change existing workflows. +* **Empowering AppSec autonomy**: This solution lets Application Security (AppSec) teams manage and scan container images independently. It lets security teams maintain oversight without bottlenecking developers or requiring them to change existing workflows. * **Scanning legacy and offline images:** If you have a large number of older images or multiple legacy tags that no longer have an active build pipeline, registry integration is the most efficient way to ensure they are still scanned for vulnerabilities. -* **Small-scale repositories:** Direct integration and UI management work best for smaller volumes of images (under 1,000). A smaller inventory makes the import process seamless and keeps the user interface fast and responsive. +* **Small-scale repositories:** Direct integration and UI management work best for smaller volumes of images (under 1,000). A smaller inventory simplifies the import process and keeps the user interface responsive. * **Limited developer bandwidth:** If your development team lacks the availability to update build pipelines or integrate new security tools into their current processes, direct registry scanning provides a frictionless alternative. ### Use cases for CI/CD or CLI @@ -251,7 +251,7 @@ This configuration is specific to asset management and is separate from the Orga **Key decision**: Choose which metadata (tags) and application structures are most critical for your risk assessment and reporting. {% endhint %} -Once assets are imported, use the following features to organize your inventory: +After you import assets, use the following features to organize your inventory: * **Automatic tags**: Snyk automatically adds tags for detected technologies (for example, Python, Terraform). @@ -303,7 +303,7 @@ Before installation, verify your environment: 1. Install the setup CLI tool: `npm install -g snyk-broker-config` 2. Start the interactive creation workflow: `snyk-broker-config workflows connections create` 3. Follow the on-screen prompts to input your Snyk Token, Tenant or Org ID, and select the specific integration type you want to connect (for example, GitHub Enterprise, GitLab, or Artifactory). -4. The CLI will generate your `DEPLOYMENT_ID`, `CLIENT_ID`, and `CLIENT_SECRET`. It will also prompt you to create a credential reference name (for example, `MY_GITHUB_TOKEN`) that maps to your actual secret. Keep these values secure for the next step. +4. The CLI generates your `DEPLOYMENT_ID`, `CLIENT_ID`, and `CLIENT_SECRET`. It also prompts you to create a credential reference name (for example, `MY_GITHUB_TOKEN`) that maps to your actual secret. Keep these values secure for the next step. {% hint style="info" %} If you are setting up Snyk Essentials for asset management with over 1,000 repositories, Snyk recommends a dedicated Broker and Organization. diff --git a/discover-snyk/implementation-and-setup/enterprise-implementation-guide/create-a-template-organization/structure-your-account.md b/discover-snyk/implementation-and-setup/enterprise-implementation-guide/create-a-template-organization/structure-your-account.md index bc4ef05b4ebd..74cc5965dad5 100644 --- a/discover-snyk/implementation-and-setup/enterprise-implementation-guide/create-a-template-organization/structure-your-account.md +++ b/discover-snyk/implementation-and-setup/enterprise-implementation-guide/create-a-template-organization/structure-your-account.md @@ -12,4 +12,4 @@ Snyk Organizations (Orgs) are the primary level for managing Projects and user a | -------------------------- | --------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------- | | **Team-based** | Linked to a specific developer or security team. | Strict security ownership and reporting by team. | Multiple teams need access to the exact same set of projects (leads to complexity). | | **Product-based** | Set up for distinct applications or product lines (for example, product a front-end, product a back-end). | Product-centric reporting and access control. | You have hundreds of small, unrelated products. | -| **SCM Organization-based** | Mimics your SCM hosting platform structure (for example Github orgs, Gitlab groups). | Automated onboarding using the Snyk API, when you have more than 10 SCM-related integrations. | Your SCM organization names are not intuitive or don't align with business units. | +| **SCM Organization-based** | Mimics your SCM hosting platform structure (for example, GitHub orgs, GitLab groups). | Automated onboarding using the Snyk API, when you have more than 10 SCM-related integrations. | Your SCM organization names are not intuitive or don't align with business units. | diff --git a/discover-snyk/implementation-and-setup/enterprise-implementation-guide/create-your-snyk-structure.md b/discover-snyk/implementation-and-setup/enterprise-implementation-guide/create-your-snyk-structure.md index 6f11dabdfee6..431ffbc2c254 100644 --- a/discover-snyk/implementation-and-setup/enterprise-implementation-guide/create-your-snyk-structure.md +++ b/discover-snyk/implementation-and-setup/enterprise-implementation-guide/create-your-snyk-structure.md @@ -27,7 +27,7 @@ Use the following table to understand which configurations transfer to the new O | ------------------------------------------------------ | --------------------------------------------------- | | All integrations and settings | Members and Service Accounts | | SCM and Container settings | Existing Projects | -| Notification integrations (for example Slack, or Jira) | Custom policies and ignore settings | +| Notification integrations (for example, Slack or Jira) | Custom policies and ignore settings | | PaaS and serverless integrations | Infrastructure as Code (IaC) and Snyk Code settings | ## Configure scan and notification behavior diff --git a/discover-snyk/implementation-and-setup/enterprise-implementation-guide/initial-team-rollout.md b/discover-snyk/implementation-and-setup/enterprise-implementation-guide/initial-team-rollout.md index 670700af9d11..071729d39fd5 100644 --- a/discover-snyk/implementation-and-setup/enterprise-implementation-guide/initial-team-rollout.md +++ b/discover-snyk/implementation-and-setup/enterprise-implementation-guide/initial-team-rollout.md @@ -18,7 +18,7 @@ Follow these steps to roll out Snyk to your teams: Managing notifications ensures that developers only see high-priority issues that require action. * Instruct administrators to manually enable the critical alerts through their personal settings if they need to monitor progress. -* Once the environment is stable, enable notifications in bulk for **High** and **Critical** severities only. +* After the environment is stable, enable notifications in bulk for **High** and **Critical** severities only. * Disable all email notifications for new Organizations. Navigate to **Group** > **Settings** to view the notification defaults overview. @@ -58,7 +58,7 @@ Use these templates to introduce Snyk. Replace the bracketed text with your spec **Key decision**: Evaluate the maturity of your AppSec program. For new programs, introduce plugins as a tool to validate fixes for prioritized issues. For mature programs, provide immediate access to prevent new issues from entering the codebase. {% endhint %} -Snyk IDE plugins allow developers to find and fix vulnerabilities before they reach the CI/CD pipeline. This shift-left approach reduces the time spent on security reviews. +Snyk IDE plugins let developers find and fix vulnerabilities before they reach the CI/CD pipeline. This shift-left approach reduces the time spent on security reviews. 1. Identify the primary IDEs used by your teams (VS Code, JetBrains, Visual Studio, or Eclipse). 2. Provide installation guides for the relevant Snyk IDE extension. diff --git a/discover-snyk/implementation-and-setup/enterprise-implementation-guide/manage-and-remediate-issues.md b/discover-snyk/implementation-and-setup/enterprise-implementation-guide/manage-and-remediate-issues.md index da4021a7341d..5f173e2b0071 100644 --- a/discover-snyk/implementation-and-setup/enterprise-implementation-guide/manage-and-remediate-issues.md +++ b/discover-snyk/implementation-and-setup/enterprise-implementation-guide/manage-and-remediate-issues.md @@ -1,6 +1,6 @@ # Manage and remediate issues -After establishing visibility and prevention measures, focus on managing your existing vulnerability backlog. This stage involves defining a fix strategy, prioritizing issues based on risk, and operationalizing the remediation process in your development teams. Effective management ensures that your security posture improves over time rather than just maintaining the status quo. +After establishing visibility and prevention measures, focus on managing your existing vulnerability backlog. This stage involves defining a fix strategy, prioritizing issues based on risk, and operationalizing the remediation process in your development teams. Effective management ensures that your security posture improves over time rather than maintaining the status quo. To manage and remediate issues, follow these stages: @@ -30,7 +30,7 @@ Key decision: Choose a primary metric for triage. Use **Priority Score** (900+) Use Snyk filters iteratively to build your plan: * **Risk and priority scores**: Start with scores of 900–1000 and work downward. -* **Severity**: filter for **Critical** and **High** issues. +* **Severity**: Filter for **Critical** and **High** issues. {% hint style="info" %} For Snyk Open Source, prioritize critical issues with a **Fixable** filter to identify quick wins. @@ -51,7 +51,7 @@ Operationalize the fix process using: * **Ignore policy**: Use the **Ignore** feature for issues that cannot be fixed immediately due to environmental context or breaking changes. {% hint style="info" %} -Ensure to always include a detailed reason and always set an expiration date (monthly or quarterly) for review. +Always include a detailed reason and set an expiration date (monthly or quarterly) for review. {% endhint %} * **Permissions**: Restrict ignore permissions to Organization admins in the general settings to maintain oversight. diff --git a/discover-snyk/implementation-and-setup/enterprise-implementation-guide/phase-3-gain-visibility/README.md b/discover-snyk/implementation-and-setup/enterprise-implementation-guide/phase-3-gain-visibility/README.md index ca41b4f9989a..9dee76ee7043 100644 --- a/discover-snyk/implementation-and-setup/enterprise-implementation-guide/phase-3-gain-visibility/README.md +++ b/discover-snyk/implementation-and-setup/enterprise-implementation-guide/phase-3-gain-visibility/README.md @@ -1,6 +1,6 @@ # Gain visibility by importing repositories -Gaining visibility over your Organization security begins with importing Projects. This process allows Snyk to monitor your code, dependencies, containers, and infrastructure. +Gaining visibility over your Organization security begins with importing Projects. This process lets Snyk monitor your code, dependencies, containers, and infrastructure. There are several ways you can import Projects, depending on your tech stack and package managers: @@ -63,11 +63,11 @@ Use the API to trigger scans and handle results programmatically across a large ## Add Projects tags and attributes -After importing Projects, use Project attributes and tags to categorize your data. This metadata allows you to filter and report on specific subsets of your Organization. +After importing Projects, use Project attributes and tags to categorize your data. This metadata lets you filter and report on specific subsets of your Organization. For example, apply the `frontend` attribute and a `Team:Unicorn` tag to your Projects. You can then generate a report specifically for critical frontend vulnerabilities in production owned by Team Unicorn. -Attributes and tags also allow you to: +Attributes and tags also let you: * Group related Projects for easier management. * Customize how you view and access Project data. diff --git a/discover-snyk/implementation-and-setup/enterprise-implementation-guide/trial-limitations.md b/discover-snyk/implementation-and-setup/enterprise-implementation-guide/trial-limitations.md index 2f7419a5fd8b..4d71d6a2d176 100644 --- a/discover-snyk/implementation-and-setup/enterprise-implementation-guide/trial-limitations.md +++ b/discover-snyk/implementation-and-setup/enterprise-implementation-guide/trial-limitations.md @@ -1,12 +1,12 @@ # Trial limitations -You can try out Snyk functionalities in several ways: +You can try out Snyk functionality in several ways: * Using the limited Free plan * Using a self-serve 14-day trial -* By piloting the full product with the Enterprise plan +* Piloting the full product with the Enterprise plan -The Snyk 14-day trial offers a sample of the features available in the paid Enterprise plan. However, certain features will have limited functionality or be entirely unavailable in order to provide a seamless experience when the trial concludes. +The Snyk 14-day trial offers a sample of the features available in the paid Enterprise plan. However, certain features have limited functionality or are entirely unavailable to provide a smooth experience when the trial concludes. {% hint style="info" %} After implementing Snyk Essentials, you must access the Inventory page to ensure it is populated with all the necessary information. Depending on the number of repositories you have imported, the update may take up to several hours. diff --git a/discover-snyk/implementation-and-setup/enterprise-setup/auto-provisioning-guide.md b/discover-snyk/implementation-and-setup/enterprise-setup/auto-provisioning-guide.md index 9e3a03b03a85..bdfaef429390 100644 --- a/discover-snyk/implementation-and-setup/enterprise-setup/auto-provisioning-guide.md +++ b/discover-snyk/implementation-and-setup/enterprise-setup/auto-provisioning-guide.md @@ -32,26 +32,26 @@ This email contains two links: 2. **Create and activate a new account** - To be used if you're entirely new to Snyk or want to start from scratch with a different user. {% hint style="warning" %} -Once provisioning is complete, these links will become invalid and you will see an "Access denied" error page. +After provisioning is complete, these links become invalid and you see an "Access denied" error page. -If you have not completed provisioning but still see this error, make sure someone else in your organization has not already completed the flow themselves, in case the welcome email has more recipients. +If you have not completed provisioning but still see this error, ensure someone else in your organization has not already completed the flow themselves, in case the welcome email has more recipients. {% endhint %} ## Sign up - start from scratch -Clicking the sign-up link in your welcome email will take you to the sign-up page in the provisioning app. +Clicking the sign-up link in your welcome email takes you to the sign-up page in the provisioning app. {% hint style="warning" %} -The provisioning app is only accessible through a unique link, all other access is disabled and will show an error page. +The provisioning app is only accessible through a unique link. All other access is disabled and shows an error page. {% endhint %}
Sign up page on provision.snyk.io
Email address input
Successful provisioning for SSO
| Project Import Strategy | Considerations | Advantages | Disadvantages |
|---|---|---|---|
| CLI (automated CI/CD) | Must be configured for each application within CI/CD. |
| It requires configuration per application. |
| CLI (Run locally by user) | User can use CLI to perform testing locally while working on an application, very configurable per scan type. | Local use case | Not meant for visibility or automation. Can require buildable code or dependencies to be installed (For example Gradle without Lockfile, Scala). |
| Git Code Repository Integration | Onboarding and daily monitoring: rapid vulnerability assessment across application portfolio. |
|
|
| Pull request (PR)/merge request (MR) scanning | Immediate feedback on introduced issues on the PR/MR against any branch on repository. | Configurable rules for pass/fail |
| Project Import Strategy | Considerations | Advantages | Disadvantages |
|---|---|---|---|
| CLI (automated CI/CD) | Must be configured for each application within CI/CD. |
| It requires configuration per application. |
| CLI (Run locally by user) | User can use CLI to perform testing locally while working on an application, configurable per scan type. | Local use case | Not meant for visibility or automation. Can require buildable code or dependencies to be installed (For example Gradle without Lockfile, Scala). |
| Git Code Repository Integration | Onboarding and daily monitoring: rapid vulnerability assessment across application portfolio. |
|
|
| Pull request (PR)/merge request (MR) scanning | Immediate feedback on introduced issues on the PR/MR against any branch on repository. | Configurable rules for pass/fail |
| Task | Champion | Admin | Security | DevOps |
|---|---|---|---|---|
| Onboarding | Responsible | Responsible | Responsible | Responsible |
| Admin Training | Accountable | Responsible | Consulted | Responsible |
| Security Training | Responsible | Consulted | Accountable | Responsible |
| DevOps Training | Responsible | Consulted | Consulted | Accountable |
| Source Control/IDE/PIPELINE Setup | Responsible | Responsible | Responsible | Accountable |
| License Policy Management | Responsible | Responsible | Responsible | Accountable |
| Security Triage | Responsible | Consulted | Accountable | Consulted |
Snyk Assist on Snyk Learn
to open the chat window. This is found in the bottom right of the page.
3. Type your questions about Snyk products or application security concepts into the chat prompt.
-Snyk Assist will answer based on its knowledge base, potentially including links to relevant documentation, Learn lessons, and Snyk blogs.
+Snyk Assist answers based on its knowledge base, potentially including links to relevant documentation, Learn lessons, and Snyk blogs.
{% hint style="info" %}
If you do not see the chat icon, your Snyk admin may not have enabled this functionality for your Group. Additionally, ensure that the default Org in your Snyk settings is set to your company's Snyk Org and not a personal Snyk Org.
@@ -63,6 +63,6 @@ After Snyk Assist is enabled, it is visible and accessible on Snyk Learn for the
Snyk Assist settings page
.png)
Creating new assignments button on the Assignments Dashboard page
.png)
.png)
Optionally reset user learning progress
.png)
Snyk Project page showing dependencies in Flutter apps