Hey everyone, I’m pretty new to setting up security scanning in our CI/CD pipeline. We started using Snyk for our container images and Terraform code, and I turned on the Jira integration to track findings.
But now, every scan seems to create a huge flood of new Jira tickets — it’s overwhelming our board! 😅 I think I might have misconfigured something.
Could someone explain how to throttle or batch these ticket creations? Maybe only for high-severity issues, or on a schedule? I’m looking for a beginner-friendly step-by-step, if possible. We’re using the cloud version of Snyk.
Yeah, the default Jira integration is a beast out of the box. It'll create a ticket for every single finding across every project, including low-severity stuff like "info level" CVEs. Totally buries your board.
You can throttle this easily in the cloud UI though, no custom code needed. Here are the two main knobs:
- **Per-project severity filter.** Go to your Project > Settings > Integrations > Jira. There's a "Minimum severity" dropdown. Change it from "low" to "high" or "critical". That alone cuts out 80% of the noise in most repos.
- **Ignore rules.** For findings you've accepted as false positives or won't fix (e.g., a low-severity transitive dependency you can't upgrade), you can set an ignore rule with a reason and expiry. Snyk won't create Jira tickets for ignored issues. This keeps your board from getting spammed with the same CVE across multiple scans.
Also check your **scan frequency**. If you're feeding Snyk via a CI pipeline that runs on every commit, you're getting a full scan every push. Snyk's cloud integration is smart enough to update existing tickets rather than create duplicates, but it still triggers notifications and status changes. I'd recommend either:
1. Run your Snyk scans on a daily schedule instead of per-commit.
2. Or use the `snyk monitor` command in CI to push snapshot data to Snyk's dashboard, and then let their daily or weekly re-scan figure out the Jira tickets.
One more thing: If you have multiple repos (microservices etc.), start with just one project, dial in the severity filter, then copy those settings to the rest. Snyk doesn't have a global "batch" mode, but per-project settings apply immediately.
You mentioned Terracode too - Snyk's IaC scans tend to flag a lot of "medium" config warnings. I'd definitely filter IaC projects to "high" only unless you have compliance requirements.
Latency is the enemy, but consistency is the goal.
You're spot on about the severity filter and ignore rules. Another angle I've seen bite teams is the auto-import of new projects. If you have Snyk connected to your SCM (like GitHub), every new repo gets the default integration settings, which can suddenly flood Jira.
I'd add setting up a **Project Defaults Template** in Snyk's Org Settings. You can define baseline configs there, like a minimum severity of "high" for Jira tickets, and it'll apply to any newly imported projects automatically. Saves you from chasing down each new repo.
YAML is not a programming language, but I treat it like one.