Snyk Broker - AppRisk

If your SCM or third-party instance is not publicly accessible, you need Snyk Broker. You can install and configure your Snyk Broker using Docker or Helm. The minimum supported Broker version for Snyk AppRisk is 4.171.0.

Enable Broker for Snyk AppRisk by setting the APPRISK environment variable to true in the installation command: ACCEPT_APPRISK=true for Docker and --set enableAppRisk=true for Helm.

SCM integrations

• GitHub - install and configure Snyk Broker

  • using Docker

  • using Helm

  • environment variables

• GitHub Enterprise - install and configure Snyk Broker:

  • using Docker

  • using Helm

  • environment variables

• BitBucket - install and configure Snyk Broker:

  • using Docker

  • using Helm

  • environment variables

• GitLab - install and configure Snyk Broker:

  • using Docker

  • using Helm

  • environment variables

• Azure - install and configure Snyk Broker:

  • using Docker

  • using Helm

  • environment variables

You can find on GitHub all the updated .json files that include the allowed list of accessible endpoints for the integrations.

Third-party integrations

The third-party integrations are available in a Closed Beta state and are applicable only to the Snyk AppRisk Pro version. Please contact your salesperson if you are interested in Snyk AppRisk Pro.

Checkmarx SAST integration

Use the following steps to install and run Snyk Broker for the AppRisk and Checkmarx SAST integration.

1. Ensure you have the Snyk Broker token for the Snyk AppRisk integration. The Snyk support team can provide the needed token.

2. Pull the latest broker image by running this command:

docker pull snyk/broker:universal

3. Ensure the config.universal.json file contains the following information:

{
  "BROKER_CLIENT_CONFIGURATION": {
    "common": {
      "default": {
        "BROKER_SERVER_URL": "https://broker.snyk.io",
        "BROKER_HA_MODE_ENABLED": "false"
      }
    }
  },
  "CONNECTIONS": {
    "apprisk connection": {
      "type": "apprisk",
      "identifier": "${BROKER_TOKEN}",
      "CHECKMARX": "${CHECKMARX}",
      "CHECKMARX_USERNAME": "${CHECKMARX_USERNAME}",
      "CHECKMARX_PASSWORD": "${CHECKMARX_PASSWORD}",
      "BROKER_CLIENT_URL": "http://my.broker.client.dns.hostname"
    }
  }
}

4. Run the following commands with your Checkmarx username and password:

docker run --restart=always \
        -p 8001:8001 -e PORT=8001 \
        -e BROKER_CLIENT_URL=http://broker.url.example:8000 \
        -e BROKER_TOKEN=<YOUR BROKER TOKEN> \
        -e UNIVERSAL_BROKER_ENABLED=true \
        -e CHECKMARX=<YOUR CHECKMARX HOST> \
        -e CHECKMARX_USERNAME=<YOUR CHECKMARX USERNAME> \
        -e CHECKMARX_PASSWORD=<YOUR CHECKMARX PASSWORD> \
        -e BROKER_SERVER_URL=https://broker.snyk.io \
        -v $(pwd)/config.universal.json:/home/node/config.universal.json \
    snyk/broker:universal

5. When the connection is established, you will find in the logs the following message: successfully established a websocket connection to the broker server

{"id":"broker-client-url-validation","name":"Broker Client URL Validation Check","status":"passing","output":"config check: ok"},{"id":"universal-broker-connections-config-validation","name":"Universal Broker Client Connections Configuration Check","status":"passing","output":"connections config check: ok"}],"version":"4.179.5","supportedIntegrationType":"apprisk"},"msg":"successfully established a websocket connection to the broker server","time":"2024-03-11T11:43:26.014Z","v":0}