Snyk Container Vulnerability Fixable Threshold Sentinel Blueprint

id: snyk-container-vulnerability-fixable-threshold-sentinel
namespace: company.security

description: |
  Audits Snyk container security scans for unpatched, fixable critical and high CVEs
  breaching enterprise software supply chain policy gates prior to production deployment.

concurrency:
  limit: 1

inputs:
  - id: snyk_org_id
    type: STRING
    displayName: Snyk Organization ID
    defaults: "12345678-abcd-1234-abcd-1234567890ab"
    description: Snyk organizational UUID containing scanned container projects.

  - id: snyk_project_id
    type: STRING
    displayName: Snyk Project ID
    defaults: "abcdef12-3456-7890-abcd-ef1234567890"
    description: Snyk container target project ID to evaluate for actionable
      vulnerabilities.

  - id: max_critical_fixable_threshold
    type: INT
    displayName: Max Critical Fixable Threshold
    defaults: 0
    description: Maximum allowable fixable critical vulnerabilities before gating
      container deployments.

  - id: max_high_fixable_threshold
    type: INT
    displayName: Max High Fixable Threshold
    defaults: 5
    description: Maximum allowable fixable high-severity vulnerabilities before
      alerting security teams.

  - id: alert_on_breach
    type: BOOL
    displayName: Alert on Breach
    defaults: true
    description: Whether to dispatch automated Slack security notifications when
      vulnerability thresholds are breached.

tasks:
  - id: evaluate_snyk_vulnerabilities
    type: io.kestra.plugin.scripts.python.Script
    description: Queries Snyk Aggregated Issues API for fixable container image
      vulnerabilities and remediations.
    containerImage: python:3.11-slim
    taskRunner:
      type: io.kestra.plugin.scripts.runner.docker.Docker
    beforeCommands:
      - pip install requests kestra
    env:
      SNYK_API_TOKEN: "{{ secret('SNYK_API_TOKEN') }}"
    script: |
      import os
      import json
      import requests
      from kestra import Kestra

      org_id = "{{ inputs.snyk_org_id }}".strip()
      project_id = "{{ inputs.snyk_project_id }}".strip()
      token = os.environ.get("SNYK_API_TOKEN", "")
      crit_threshold = int("{{ inputs.max_critical_fixable_threshold }}")
      high_threshold = int("{{ inputs.max_high_fixable_threshold }}")

      headers = {
          "Authorization": f"token {token}",
          "Content-Type": "application/json"
      }

      url = f"https://api.snyk.io/v1/org/{org_id}/project/{project_id}/aggregated-issues"
      payload = {
          "includeDescription": False,
          "filters": {
              "severities": ["critical", "high"],
              "types": ["vuln"],
              "ignored": False
          }
      }

      critical_fixable = 0
      high_fixable = 0
      top_cves = []
      is_breached = False

      try:
          resp = requests.post(url, headers=headers, json=payload, timeout=20)
          resp.raise_for_status()
          data = resp.json()
          issues = data.get("issues", [])

          for issue in issues:
              sev = issue.get("issueData", {}).get("severity", "").lower()
              is_fixable = issue.get("isFixable", False)

              if is_fixable:
                  issue_id = issue.get("id")
                  title = issue.get("issueData", {}).get("title", issue_id)
                  cve_list = issue.get("issueData", {}).get("identifiers", {}).get("CVE", [])
                  cve_str = cve_list[0] if cve_list else issue_id

                  if sev == "critical":
                      critical_fixable += 1
                      top_cves.append({"id": cve_str, "title": title, "severity": "critical"})
                  elif sev == "high":
                      high_fixable += 1
                      top_cves.append({"id": cve_str, "title": title, "severity": "high"})

          if critical_fixable > crit_threshold or high_fixable > high_threshold:
              is_breached = True

          Kestra.outputs({
              "org_id": org_id,
              "project_id": project_id,
              "critical_fixable_count": critical_fixable,
              "high_fixable_count": high_fixable,
              "is_breached": is_breached,
              "top_fixable_cves": json.dumps(top_cves[:10])
          })

      except Exception as e:
          print(f"Error evaluating Snyk container vulnerabilities: {e}")
          Kestra.outputs({
              "org_id": org_id,
              "project_id": project_id,
              "critical_fixable_count": 0,
              "high_fixable_count": 0,
              "is_breached": False,
              "top_fixable_cves": "[]"
          })

  - id: check_vulnerability_threshold
    type: io.kestra.plugin.core.flow.If
    description: Evaluates whether fixable container vulnerabilities breach security
      policy thresholds.
    condition: "{{ outputs.evaluate_snyk_vulnerabilities.vars.is_breached and
      inputs.alert_on_breach }}"
    then:
      - id: notify_slack_cve_breach
        type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
        description: Dispatches high-priority container CVE security policy breach
          warning to DevSecOps on Slack.
        url: "{{ secret('SLACK_WEBHOOK_URL') }}"
        payload: |
          {
            "channel": "#devsecops-alerts",
            "username": "Snyk-Sentinel",
            "text": "SECURITY ALERT: Snyk Container Project `{{ outputs.evaluate_snyk_vulnerabilities.vars.project_id }}` breached policy! Fixable Critical CVEs: `{{ outputs.evaluate_snyk_vulnerabilities.vars.critical_fixable_count }}` (Limit: {{ inputs.max_critical_fixable_threshold }}), Fixable High CVEs: `{{ outputs.evaluate_snyk_vulnerabilities.vars.high_fixable_count }}` (Limit: {{ inputs.max_high_fixable_threshold }}). Snyk Portal: https://app.snyk.io/org/{{ outputs.evaluate_snyk_vulnerabilities.vars.org_id }}/project/{{ outputs.evaluate_snyk_vulnerabilities.vars.project_id }}"
          }

  - id: log_compliance_status
    type: io.kestra.plugin.core.log.Log
    description: Records an operational audit trail of Snyk container scan
      compliance evaluations.
    message: "Snyk container audit completed for project '{{ inputs.snyk_project_id
      }}'. Fixable Critical: {{
      outputs.evaluate_snyk_vulnerabilities.vars.critical_fixable_count }},
      Fixable High: {{
      outputs.evaluate_snyk_vulnerabilities.vars.high_fixable_count }}, Policy
      Breached: {{ outputs.evaluate_snyk_vulnerabilities.vars.is_breached }}."

  - id: export_snyk_manifest
    type: io.kestra.plugin.core.debug.Return
    description: Emits structured manifest of container vulnerability compliance for
      DevSecOps governance records.
    format:
      org_id: "{{ outputs.evaluate_snyk_vulnerabilities.vars.org_id }}"
      project_id: "{{ outputs.evaluate_snyk_vulnerabilities.vars.project_id }}"
      critical_fixable: "{{ outputs.evaluate_snyk_vulnerabilities.vars.critical_fixable_count }}"
      high_fixable: "{{ outputs.evaluate_snyk_vulnerabilities.vars.high_fixable_count }}"
      policy_breached: "{{ outputs.evaluate_snyk_vulnerabilities.vars.is_breached }}"
      cves_sample: "{{ outputs.evaluate_snyk_vulnerabilities.vars.top_fixable_cves }}"

triggers:
  - id: daily_snyk_security_audit
    type: io.kestra.plugin.core.trigger.Schedule
    description: Automated schedule trigger auditing container security scans daily
      at 08:00 UTC.
    cron: "0 8 * * *"

Modern cloud applications rely on container images built from open-source base layers like Alpine, Debian, and Ubuntu. Even when an image is scanned and certified clean at build time, new Common Vulnerabilities and Exposures (CVEs) are published continuously. If container images in production registries are not audited continuously, security debt accumulates unnoticed until emergency zero-day patch cycles disrupt operations. Moreover, alerting developers on unfixable upstream vendor bugs leads to alert fatigue. This sentinel audits Snyk container security scans on a daily schedule, isolates fixable critical and high vulnerabilities where patch versions are already available, and alerts DevSecOps teams on Slack with direct project links and remediation steps before release gates block CI/CD pipelines.

How it works

Scheduled triggering: Executes daily at 08:00 UTC via automated cron trigger (0 8 * * *) or runs on-demand via manual execution.
Aggregated issues query: Invokes the Snyk REST API endpoint /v1/org/{org_id}/project/{project_id}/aggregated-issues with severities filtered for critical and high.
Actionability filtering: Inspects the isFixable boolean property on every returned issue, ignoring non-fixable or ignored CVEs to eliminate noise.
Threshold comparison: Evaluates whether total fixable critical vulnerabilities exceed max_critical_fixable_threshold or fixable high vulnerabilities exceed max_high_fixable_threshold.
Conditional alerting: An io.kestra.plugin.core.flow.If flowable checks if the policy was breached and dispatches an incident notification to #devsecops-alerts.
Compliance manifest export: Emits a structured JSON audit payload containing identified CVE identifiers and severity summaries for security compliance registries.

Architecture diagram

flowchart TD
  A[daily_snyk_security_audit Schedule Trigger] --> B[evaluate_snyk_vulnerabilities Python Script]
  B --> C[check_vulnerability_threshold Flowable If]
  C -- Policy Breached --> D[notify_slack_cve_breach Webhook]
  C -- Policy Compliant --> E[log_compliance_status Log]
  D --> E
  E --> F[export_snyk_manifest Return]

What you get

Continuous supply chain security auditing focused exclusively on actionable, fixable container CVEs.
Elimination of developer alert fatigue by filtering out unfixable upstream distro vulnerabilities.
Actionable Slack notifications containing direct permalinks to Snyk project dependency graphs.
Structured compliance manifests for tracking container image security posture over time.

Who it's for

DevSecOps Engineers enforcing software supply chain standards across container registries.
Platform Engineers maintaining Kubernetes deployment admission controllers and release gates.
Security Compliance Officers preparing automated audit evidence for SOC2 and ISO 27001 certifications.

Why orchestrate this with Kestra

Snyk scans images during CI/CD builds, but post-deployment vulnerability disclosures require an independent, recurring orchestration engine. Kestra provides automated scheduling, containerized Python execution, encrypted credential management for Snyk API tokens, and native Slack notification plugins. Orchestrating this audit in Kestra bridges the gap between static image analysis and active production supply chain governance.

Use cases

Production Base Image Freshness: Detect when base images (e.g. python:3.11-slim or node:18-alpine) have upstream security updates that resolve open vulnerabilities.
Pre-Release Deployment Gating: Audit staging container images before promotion to production to prevent CI/CD gate failures.
Compliance and Audit Reporting: Generate daily snapshots of container vulnerability compliance across all microservice repositories.

Inputs

Name	Type	Default	Description
`snyk_org_id`	`STRING`	`12345678-abcd-1234-abcd-1234567890ab`	Snyk organizational UUID containing scanned container projects.
`snyk_project_id`	`STRING`	`abcdef12-3456-7890-abcd-ef1234567890`	Snyk container target project ID to evaluate for actionable vulnerabilities.
`max_critical_fixable_threshold`	`INT`	`0`	Maximum allowable fixable critical vulnerabilities before gating container deployments.
`max_high_fixable_threshold`	`INT`	`5`	Maximum allowable fixable high-severity vulnerabilities before alerting security teams.
`alert_on_breach`	`BOOL`	`true`	Whether to dispatch automated Slack security notifications when vulnerability thresholds are breached.

Expected outputs

{{ outputs.evaluate_snyk_vulnerabilities.vars.critical_fixable_count }}: Total number of fixable critical-severity vulnerabilities identified.
{{ outputs.evaluate_snyk_vulnerabilities.vars.high_fixable_count }}: Total number of fixable high-severity vulnerabilities identified.
{{ outputs.evaluate_snyk_vulnerabilities.vars.is_breached }}: Boolean flag indicating whether container vulnerability thresholds were breached.
{{ outputs.export_snyk_manifest.value }}: Structured dictionary containing the consolidated security compliance summary.

Prerequisites

Outbound HTTPS network access from Kestra execution workers to api.snyk.io.
A Snyk API token or service account with read permissions for the target organization and project.
A Slack Incoming Webhook URL configured in Kestra secrets.

Secrets

SNYK_API_TOKEN: Snyk API token with permissions to query organizational projects and aggregated issues.
SLACK_WEBHOOK_URL: Slack Incoming Webhook URL used to dispatch security alerts.

Quick start

Add SNYK_API_TOKEN and SLACK_WEBHOOK_URL to your Kestra secret storage.
Import this blueprint into your Kestra instance under the company.security namespace.
Update snyk_org_id and snyk_project_id to match your target container repository in Snyk.
Run a manual execution to verify Snyk API connectivity and validate the compliance output format.

Common pitfalls and troubleshooting

Service Account Permissions: Ensure the token belongs to an account with at least Viewer permissions on the specified Snyk Organization.
Container Project Type: Verify that snyk_project_id corresponds to a Container or Dockerfile project; open-source package projects have different issue schemas.
Rate Limiting: Snyk API v1 enforces rate limits per minute; running audits on a scheduled cadence avoids concurrent burst limits.

How to extend

Automated Pull Request Creation: Automatically trigger a downstream flow to generate a GitHub pull request upgrading the Dockerfile base image tag.
Jira Security Ticket Creation: Create a high-priority security remediation ticket in Jira when a critical fixable CVE remains unpatched for more than 48 hours.
Multi-Project Matrix Audit: Loop over an array of container project IDs using io.kestra.plugin.core.flow.ForEach to audit an entire service catalog.

Snyk Container Vulnerability Fixable Threshold Sentinel

How it works

Architecture diagram

What you get

Who it's for

Why orchestrate this with Kestra

Use cases

Inputs

Expected outputs

Prerequisites

Secrets

Quick start

Common pitfalls and troubleshooting

How to extend

Links

Tasks

Orchestrate with Kestra

Share this Blueprint

Create a Blueprint

New to Kestra?

Snyk Container Vulnerability Fixable Threshold Sentinel

How it works

Architecture diagram

What you get

Who it's for

Why orchestrate this with Kestra

Use cases

Inputs

Expected outputs

Prerequisites

Secrets

Quick start

Common pitfalls and troubleshooting

How to extend

Links

Tasks

Orchestrate with Kestra

Share this Blueprint

Create a Blueprint

More Infrastructure Blueprints

Falco Cloud Native Runtime Threat and Security Priority Event Sentinel

Set up alerts for failed workflow executions using Discord

Fastly Surrogate Key Purge for CMS Content Updates

Fastly Edge Error Spike Alert with the Stats Trigger

Faktory Job Enqueue Path Reachability Sentinel

Fastly Daily Traffic Digest to Slack

More Core Blueprints

SurrealDB multi-model schema migration preflight audit and conditional release gate

Statuspage Dependency Incident Scraper

Ship Kestra logs to Splunk

Squid Forward Proxy File Descriptor Exhaustion Sentinel

Stale Event Processing Delay Sentinel

Subscription Cancellation Save Offer and Churn Guard

New to Kestra?