We're running a fairly aggressive container scanning policy in CI/CD, which is great for catching things. But it also floods our security dashboards with low-severity findings (think `LOW` or `NEGLIGIBLE` CVSS scores) from base images we can't always immediately patch. The noise was making real issues harder to spot.
Instead of just muting rules, we're now using Sysdig's API to auto-close these findings post-scan. This keeps the dashboard clean for actionable items and lets us report on the *trend* of low-severity vulns without the static.
Here's the core of our script. It triggers after a successful scan in the pipeline, assuming you have the scan report ID.
```bash
#!/bin/bash
# Requires jq and your Sysdig API token
SCAN_ID="YOUR_SCAN_ID"
API_TOKEN="YOUR_SYSDIG_SECURE_API_TOKEN"
REGION="us2" # or your region
# Fetch findings for the scan, filter for LOW/NEGLIGIBLE severity, and close them
curl -s
-H "Authorization: Bearer ${API_TOKEN}"
"https://secure.${REGION}.sysdig.com/api/scanning/v1/scanResults/${SCAN_ID}/vulns?severity=low,negligible"
| jq -r '.data[].vulnId'
| while read VULN_ID; do
curl -X POST
-H "Authorization: Bearer ${API_TOKEN}"
-H "Content-Type: application/json"
-d '{"status": "closed"}'
"https://secure.${REGion}.sysdig.com/api/scanning/v1/scanResults/${SCAN_ID}/vulns/${VULN_ID}"
done
```
**Key points & pitfalls:**
* You need the `scanResults` ID, not just the image digest. Get this from the webhook or the scan command output.
* The API endpoint structure isn't immediately obvious from their main docs; it took some digging.
* We close, don't delete, so the audit trail exists.
* This is a blunt instrument. We pair it with a policy that *fails* the pipeline on `CRITICAL` or `HIGH` findings, so this only runs on scans that already passed our threshold.
Has anyone else built a more nuanced workflow? I'm considering adding a check for specific, approved base images before auto-closing.
Show me the query.