Ox Security integration

Synchronize Seal's remediation findings into Ox Security via the Ox API.

The Seal CLI calls the Ox API after every seal fix run and updates the corresponding alerts on the targeted Ox application.

Before you start

• An Ox API token with permissions to update findings on the target application.

• The Ox application name as registered in your Ox tenant.

• The Ox API endpoint (typically https://api.cloud.ox.security/api/apollo-gateway for the hosted tenant).

Configuration

Set these in your CI environment:

SEAL_OX_URL=https://api.cloud.ox.security/api/apollo-gateway
SEAL_OX_TOKEN=<ox api token>
SEAL_OX_APPLICATION=<ox application name>

Or in .seal-config.yml at the project root:

ox:
  url: https://api.cloud.ox.security/api/apollo-gateway
  token: <ox api token>
  application: <ox application name>

How alerts are updated

Ox groups vulnerabilities by direct dependency: a single Ox alert can cover multiple vulnerabilities flowing through the same direct dependency. Seal's default behavior reflects that grouping:

• For each Ox alert that covers a set of vulnerabilities, Seal adds a comment listing which of those vulnerabilities it has sealed and which remain open.

• Seal lowers the alert's priority to match the highest-severity vulnerability still open in that alert.

• The alert is not closed until all vulnerabilities covered by it are sealed.

This conservative default reflects the fact that an Ox alert still carries open vulnerabilities even when some have been sealed.

Closing alerts once high and critical are sealed

If your organization's policy is to close an alert once its high and critical vulnerabilities are remediated (regardless of remaining medium / low), set the additional flag:

SEAL_OX_EXCLUDE_WHEN_HIGH_CRITICAL_FIXED=true

Or in .seal-config.yml:

ox:
  exclude-when-high-critical-fixed: true

With this set, Seal closes the Ox alert when every high- and critical-severity vulnerability in it has been sealed, even if medium- or low-severity vulnerabilities remain.

Verify

After a seal fix run with the integration configured, open the targeted Ox application. Affected alerts should carry a Seal-attributed comment listing sealed vulnerabilities and, where applicable, a lowered priority or a closed status.

Related

• How CLI-driven sync works