Having just come out of a fairly intensive Mend (WhiteSource) integration project for a client, I wanted to share some first impressions on the post-signup integration process. The short answer is: **it's conceptually straightforward but requires careful planning and a bit of custom scripting to achieve a fully automated, production-ready workflow.**
The onboarding dashboard does a good job of presenting the primary integration paths: SCA via the Unified Agent, SCA via CI/CD plugins, and SAST. The guided steps for connecting your source control (GitHub, GitLab, Bitbucket) are clear, and the Mend bot establishes itself without much fuss. Where the complexity begins is when you move beyond the happy path and need to tailor the data flow to your specific development and security governance.
Here’s a breakdown of the key integration points and where I had to build some glue:
* **Unified Agent & CI/CD:** Running the agent in a pipeline (Jenkins, in my case) is well-documented. The main configuration hurdle is managing the `wss-unified-agent.config` file. You'll likely need a separate, version-controlled config for each project/repo to manage exclusions and thresholds appropriately. I ended up generating this config dynamically in the pipeline.
* **API & Webhooks:** This is where the real power (and work) lies for automation. The Mend REST API is robust, but using it to sync vulnerability data into our internal dashboards required some custom scripting. Their webhooks are essential for real-time alerts.
For example, to automatically create a Jira ticket for high-severity new vulnerabilities, I set up a webhook from Mend to a Make.com scenario. The webhook payload is rich, but you need to parse it to extract the specific library and vulnerability details.
```json
// Sample snippet from a Mend webhook payload (Alerts/Vulnerability)
{
"eventType": "ALERT_RAISED",
"data": {
"alert": {
"type": "SECURITY_VULNERABILITY",
"project": {
"name": "your-project-name"
},
"library": {
"name": "lodash",
"version": "4.17.20"
},
"vulnerability": {
"score": "HIGH",
"cveName": "CVE-2020-8203"
}
}
}
}
```
* **Remediation & PR Comments:** The Mend bot auto-comments on PRs, which is great. To make this more actionable, I wrote a small middleware service that parses these comments and can automatically generate a dependency update PR if the fix is a simple version bump, using the Mend API to fetch the recommended version.
**Pitfalls to watch for:**
- The initial scan can be overwhelming. **Set your policy rules and severity thresholds *before* the first full scan** to avoid alert fatigue.
- Inventory management (especially for containers) requires careful tagging in your Mend projects to map to your internal environments (dev/staging/prod).
- If you have a complex monorepo, the standard CI/CD plugin might not segment results as you'd like. You may need to run the Unified Agent multiple times with different `-d` scan paths.
Overall, the platform provides all the necessary components, but a truly seamless integration that fits into your existing SDLC and security toolchain will require investment in API-based automation. The documentation is sufficient, but be prepared to spend time in the API Explorer and potentially build some lightweight middleware to bridge the gaps.
api first
api first
Spot on about managing the config file. That's where most teams get lazy and then wonder why they're flooded with false positives or missing critical issues. Setting up a templating system for those configs early is non-negotiable.
Your Jenkins mention is key. The CI plugins work until you need fine-grained control over scan timing or artifact handling. I've had to write wrapper scripts to handle pre-merge vs. nightly scan logic because the out-of-the-box pipeline steps weren't granular enough.
Also, their API for pulling results into our own dashboards was more clunky than expected. The data's there, but you'll do some extra work to normalize it against your other security tools.