stackhawk-api-recipes

StackHawk API Reporting Recipes

Pre-built compositions for common security reporting questions using hawk op. Run hawk op status first to confirm authentication; set HAWK_API_KEY for CI/CD pipelines.

Setup (run once per shell session for CI/CD):

export HAWK_API_KEY="hawk.xxxxxxxxxxxx"   # from app.stackhawk.com → Settings → API Keys

---

Recipe 1: Org Security Posture

Question: Across all my apps, what is the current security situation?

What it produces: One row per app showing latest-scan finding counts by severity, sorted by High findings descending.

Step 1 — Fetch all apps and recent scans

apps=$(hawk op app list --format json)
scans=$(hawk op scan list --limit 500 --format json)

Step 2 — Build the posture table

# Join latest scan per app to get severity counts
printf '%s\n%s' "${apps}" "${scans}" | jq -rs '
  .[0] as $apps | .[1] as $scans |

  # Build app name lookup: applicationId -> name
  ($apps.data | map({(.id): .name}) | add // {}) as $names |

  # Find latest completed scan per app
  ($scans.data
    | group_by(.applicationId)
    | map(
        sort_by(.startedTimestamp) | reverse |
        map(select(.status == "COMPLETED")) | .[0]
      )
    | map(select(. != null))
  ) as $latest |

  # Output sorted by High desc
  ($latest | sort_by(.highAlertCount // 0 | . * -1))
  | ["APP", "ENVIRONMENT", "HIGH", "MEDIUM", "LOW", "LAST_SCAN"],
    (.[] | [
      ($names[.applicationId] // .applicationId),
      (.environmentName // "—"),
      (.highAlertCount   // 0 | tostring),
      (.mediumAlertCount // 0 | tostring),
      (.lowAlertCount    // 0 | tostring),
      (.startedTimestamp // "never")
    ])
  | @tsv
' | column -t -s $'\t'

Output format

APP            ENVIRONMENT   HIGH  MEDIUM  LOW  LAST_SCAN
payment-api    Production    5     12      8    2024-01-15T10:30:00Z
auth-service   Staging       3     4       1    2024-01-10T09:00:00Z
admin-portal   Development   0     0       0    2023-11-01T08:00:00Z