Insights setup

Prerequisites

To get value from Insights, you must choose an application where you are using Snyk Container to scan the images. You can get additional value by also scanning your open source dependencies with Snyk Open Source and your source code with Snyk Code.

Snyk Insights operates by providing you with 3 risk factors for your vulnerabilities:

• OS Condition: Does this vulnerability apply to my operating system?

• Deployed: Is my code and container image deployed anywhere?

• Public Facing: Does my container have any internet exposure?

In order to get data about these 3 risk factors, you need to meet the following criteria:

• [OS Condition] Source code & dependencies are being built into a container image and scanned with Snyk Container - this is the minimum requirement to get value from Insights

• [Deployed & Public Facing] This container image is deployed to a kubernetes cluster, where you’re able to deploy the Kubernetes Connector - by making sure these 2 requirements are satisfied, you get data for all 3 risk factors about the code in your scanned image

Snyk’s recommendation is that you also perform the following steps in order to get the maximum value out of Insights:

• Scan the third party dependencies using Snyk Open Source

• Scan the source code using Snyk Code

By doing these two actions, both the source code and the third party dependencies will get risk factors data, meaning you get the application context to better prioritize your open issues.

Good practice tip

We recommend picking one application to start with, and then expanding from there.

Process overview

1. User Permissions: Granting users the Group Viewer role

2. Kubernetes Connector: Create the required Organization, roles, permissions, and deploy the agent

3. Image scanning: Scan your images properly so Insights has access to the right data

4. Associating Snyk Open Source, Code & Container Projects: set up the required linking for the application you want to use Insights on.