Hey everyone! I've been deep in the weeds with Mend (formerly WhiteSource) for the last six months, rolling it out across our dev and security teams. Overall, it's been a solid win for visibility into our open-source dependencies.
We're now looking at the bigger security picture and trying to centralize our alerting. Our security operations team lives and breathes by our SIEM (we use Splunk). They've asked if we can pipe Mend's high-severity vulnerability findings directly into it as a data source. The idea is to have all critical security alerts—from infra, apps, and now supply chain—in one dashboard for correlation and faster response.
I've poked around in the Mend documentation and admin panel. I see it has a bunch of integrations (Jira, Slack, Jenkins, etc.) and a REST API, but I'm not seeing a pre-built SIEM connector or clear guidance on this specific use case.
My questions for the community:
* Has anyone successfully integrated Mend alert data into a SIEM like Splunk, Azure Sentinel, or Sumo Logic?
* If so, how did you architect it?
* Did you use webhooks to an intermediate service?
* Are you polling the API directly from the SIEM?
* What specific data points (beyond just CVE ID and severity) are you sending over that the SOC found useful?
* Were there any hurdles with data formatting, volume, or alert fatigue?
I'm especially keen to hear about the practical steps and any "gotchas." Our goal isn't just to dump data, but to create actionable, high-fidelity alerts for our SOC. Any insights from your own experiences would be incredibly helpful!
happy evaluating!
Hey, we actually did this at my last place with Splunk. We didn't find a pre-built connector either. Our route was using Mend's webhook for "New Security Vulnerability Alerts" and pointing it at a small AWS Lambda function. That Lambda reformatted the JSON payload into the Common Event Format (CEF) our Splunk HTTP Event Collector expected.
It worked pretty well for real-time high-severity alerts. Just be mindful of volume - you'll want to filter on severity in the webhook config or your intermediary service, or you'll flood your SIEM. The API is solid for historical pull if you need it, but the webhook was enough for us.
One thing I'd check: make sure the payload includes the fields your SecOps team actually needs for correlation, like project ID, CVE, CVSS score, and the affected library. Sometimes you need to enrich the webhook data with a quick API call from that Lambda.
Dashboards or it didn't happen.
We're considering the same setup. User319's Lambda approach seems solid for real-time.
Did you look at the Mend Events API? We found it better than the generic webhook for filtering by severity right at the source. You can set the alert threshold in the API call itself, which keeps the event volume manageable before it hits any middleware.
What fields did your SecOps team say were mandatory? We're stuck debating whether to include the full library tree or just the direct dependency.