Arnica integration
Add exploitability verdicts with evidence to Arnica SCA and SAST findings, and send approved SCA dismissals back to Arnica.
Integration details
Primary category
AppSec Posture Management
Sync direction
Arnica ↔ Konvu
Konvu imports Arnica findings once a day and on demand. SCA dismissals made in Konvu set the Arnica risk status to risk accepted.
Status
Available
Which Arnica findings are exploitable?
Arnica surfaces dependency and code risks across your repositories. Konvu imports those findings, investigates whether each one can be exploited, and returns a verdict with evidence. When your team dismisses an SCA finding in Konvu, Konvu marks the risk as accepted in Arnica.
Arnica findings Konvu analyzes
SCA
Arnica dependency risks
Vulnerable dependencies, imported with any dismissal reason already recorded in Arnica.
SAST
Arnica code risks
Code findings in the repositories Arnica monitors.
Access and setup
An Arnica API key, entered in Konvu with a display name for the namespace.
To read findings
- Read access to findings and repositories
To write back
- The same key sets risk status. Dismissals reach Arnica only if the key is allowed to update risks.
- Konvu reads your code through your GitHub or GitLab connection, not through Arnica.
How Konvu investigates Arnica findings
What Konvu receives
The Arnica finding: for SCA, the package, version, and advisory; for SAST, the flagged code and its location.
What Konvu checks
- Whether the vulnerable package ships in production or only in development tooling.
- Whether the vulnerable function or flagged code path is reachable, and whether input an attacker controls gets to it.
- Whether your runtime and configuration match what the vulnerability needs.
What decides the verdict
Konvu returns exploitable, false positive, or inconclusive, with the reasoning behind it: the code it read, the conditions it tested, and what settled the call. When the answer depends on something only your team knows, Konvu asks a question instead of guessing.
Illustrative example
A minimist finding from Arnica
A made-up service, written to show how an investigation reads. Not a customer result.
- 1
Scanner finding
Arnica reports CVE-2021-44906, a prototype pollution in minimist before 1.2.6, in a Node.js repository.
- 2
Application context
minimist arrives through the test runner, a development dependency. The service itself parses no command-line arguments.
- 3
Investigation
Konvu traces minimist in the lockfile to the test tooling only and confirms the production build does not include it. No application code imports it.
- 4
Verdict
False positive. The package never runs in production, and nothing passes it attacker input.
- 5
Evidence
The dependency path from the test runner, the production dependency list, and the import search.
- 6
Where it ends up
An engineer dismisses the finding in Konvu, and Konvu sets the Arnica risk status to risk accepted.
Writeback and controls
What changes in Arnica
- Dismissing an SCA finding in Konvu sets the Arnica risk status to risk accepted.
- Reopening it in Konvu sets the risk status back to requires review.
Who triggers it
A person. Konvu changes risk status only when someone on your team dismisses the finding in Konvu. It does not dismiss Arnica findings on its own.
What stays with your team
- Arnica SAST findings. Konvu records the verdict and evidence, and any change in Arnica is made there.
The technical detail
More integrations
View all
Black Duck
Get an exploitability verdict with evidence for Black Duck Polaris SCA findings and Coverity SAST findings.
- SCA
- SAST
Checkmarx
Send Checkmarx One SCA and SAST results to Konvu for an exploitability verdict with evidence, through the Konvu API or a report upload.
- SAST
- SCA
GitHub
Prioritize GitHub CodeQL and Dependabot alerts by adding exploit context to each finding.
- SAST
- SCA
- Ticketing & Messaging
GitLab
Add exploitability analysis to GitLab's built-in SAST and SCA pipeline findings.
- SCA
- SAST
- Ticketing & Messaging
Semgrep
Find out which Semgrep Supply Chain and Semgrep Code findings are exploitable, with the evidence behind each verdict.
- SAST
- SCA
Snyk
Find out which Snyk Open Source and Snyk Code findings are exploitable in your code, with the evidence behind each verdict.
- SCA
- SAST
- Container Security