Snyk can consume ServiceNow® CMDB data and utilize key fields for searching, setting policies, and providing application context to your repository based assets.

Requirements

• Permissions outlined in the Configuration section
• Data requirements
  • Records in CMDB must have a fully qualified URL to the relevant repository
  • Snyk supports text fields and reference fields (i.e. Query that displays records from another table)
• Snyk Enterprise plan (AppRisk Essentials included) for access to Inventory, Issues, and Integrations access.
• Snyk AppRisk Pro plan for access to Application Analytics, in addition to the Snyk AppRisk Essentials features mentioned above.
• This feature is Early Access, you will need to be a participant to gain access.

Access Requirements by System

Configuration will require several levels of access across systems

ServiceNow® CMDB

1. Access to create service account used by Snyk. More information on managing tokens can be found here.
2. Access to review fieldnames and tablenames in ServiceNow® CMDB for configuring Snyk. For context, depending on how you define Applications within the configuration items of CMDB, you will need to locate the field names within the appropriate CMDB table. For example, the environment shown in the following series of videos defines applications in the cmdb_ci_business_app table. Use the ServiceNow System Definition Tables to locate the appropriate table and identify the fields within that table to map for the integration. These will be used for field mapping in the ServiceNow® CMDB setup within Snyk.

Snyk

1. Group admin access/Access to create/edit Integrations at the group level within Snyk
2. Access to Group level to review Snyk AppRisk features such as Analytics and Inventory.

ServiceNow CMDB Tasks

• Identify the following values to map within Snyk
  • Table name
  • Field that represents the repository URL for the asset
  • Catalog Name
  • Title
  • Category
  • Lifecycle
  • Owner
  • Application

Integration settings configured by Snyk administrator

Navigate to Snyk Group > Integrations > Integration Hub, then select ServiceNow® CMDB.

1. Provide instance in the form of: https://(instance-name).service-now.com
2. Provide service account credentials created within ServiceNow for CMDB access.
3. Provide the name of the URL field the code repository URL would be placed, for example: url
4. Enable the checkboxes for the fields you desire to show in Snyk AppRisk, be it Owner, Lifecycle, Category, or Application.
5. If you have multiple records in the ServiceNow CMDB for different repositories that together form a larger application, the Application field allows you to associate these repository assets for reporting purposes.

Video: 5m57s

Application context data from ServiceNow CMDB is visible in:

• Inventory - filters, clicking on assets
• Policy criteria
• Application Analytics

See the following video presentation for sample policies and usage patterns.

Video 5m15s