Mend (Formerly known as Whitesource) Integration with DefectDojo

Mend Integration with DefectDojo

Mend.io, known as WhiteSource until its 2022 rebrand, makes a software composition analysis (SCA) platform that identifies the open source libraries in an application, matches them against vulnerability data, and recommends upgrades. Scans run through the Mend Unified Agent or newer Mend tooling and are reported in the Mend platform. Results can be exported as JSON: the Unified Agent's scan report, a vulnerability export from a project, or output from the Mend platform's API 3.0. DefectDojo reads all of these with one scan type.

Mend Integration with DefectDojo

We already pay for Mend to tell us which dependencies are vulnerable. What we needed was a place where those results meet our SAST, container, and pentest findings for the same service, with SLAs and owners. Importing Mend reports into DefectDojo gives each vulnerable library a Finding on the right Asset, collapses repeats from scan to scan, and carries Mend's recommended fix into the Finding so the developer reading it knows which version to move to. On DefectDojo Pro, the Mend connector can pull findings from the Mend organization on a schedule instead of relying on exported files.

Why Mend Matters

Most of the code in a modern application comes from third-party packages, and so do many of its known vulnerabilities. Mend focuses on that supply.

• It resolves direct and transitive dependencies across many package ecosystems, so a CVE three levels down still shows up.
• It recommends a concrete fix (usually an upgrade target) for each vulnerability, not just a CVE ID.
• It tracks CVSS v3 scores and vectors, which give triage a defensible starting point.
• On its own, Mend reports per project. Engineering leaders asking "how exposed is this application?" need those results combined with every other tool's output.

Advantages of This Integration

What DefectDojo adds on top of Mend:

• Deduplication by hash code. Mend findings are matched on title, severity, and description, and the parser also drops exact repeats inside one report, so a library that appears in several modules doesn't flood the Test.
• Reimport lifecycle. Reimporting the next scan into the same Test mitigates CVEs that were upgraded away, adds new ones, and reactivates any that return.
• Fix guidance on the Finding. Mend's top fix (date, message, and resolution) lands in the Mitigation field, and DefectDojo flags the Finding as having a fix available.
• CVSS context. The CVSS v3 vector and score are stored on the Finding, with a severity justification line showing both.
• Cross-tool reporting. Dependency CVEs sit beside findings from other scanners on the same Asset, which lets one SLA policy, one metrics view, and one Jira workflow cover all of them.
• Organization-wide sync (DefectDojo Pro). The Mend connector reads security findings for every project in your Mend organization through the Mend API, creating a Record per project, so new projects show up without new pipeline jobs.

How This Integration Works

DefectDojo imports Mend results with the Mend Scan scan type. The parser inspects the JSON and handles three layouts:

• A top-level libraries array, which is the Unified Agent scan report. Each library's vulnerabilities become Findings.
• A top-level vulnerabilities array, which is a project vulnerability export where each entry names its library.
• A components or response array from Mend platform (API 3.0) SCA output. With a top-level response array, only entries whose finding status is ACTIVE are imported.

1. Produce a report. With the Unified Agent, set generateScanReport=true in the agent configuration (Mend requires updateInventory=true and a user key for this). At the end of the scan the agent writes a file named like <project>-<timestamp>-scan_report.json into a mend folder in the working directory. Alternatively, export vulnerabilities as JSON from the Mend platform.

2. Import it. In the UI, open the Engagement, choose Import Scan Results, select Mend Scan, and upload the file. To automate it from a pipeline, use the API in Community Edition or DefectDojo Pro:

curl "https://YOUR_INSTANCE/api/v2/import-scan/" \
  -H "Authorization: Token $DD_API_TOKEN" \
  -F "scan_type=Mend Scan" \
  -F "file=@mend-scan_report.json" \
  -F "product_name=orders-service" \
  -F "engagement_name=CI" \
  -F "auto_create_context=true"

DefectDojo Pro users can run the same import with Universal Importer:

universal-importer import \
  --defectdojo-url "https://YOUR_INSTANCE.cloud.defectdojo.com/" \
  --scan-type "Mend Scan" \
  --report-path "./mend-scan_report.json" \
  --product-name "orders-service" \
  --engagement-name "CI" \
  --auto-create-context

3. Reimport on every scan. Send later reports to /api/v2/reimport-scan/ against the same Test so upgraded dependencies are closed automatically.

Option: Mend connector (DefectDojo Pro). Configure the connector in the DefectDojo Pro UI. You need a Mend user (a dedicated service user is recommended) with a User Key and your Organization UUID, found in the Mend App under Administration > Organization UUID. Enter the region-specific Mend API base URL for your organization in Location, the user's login email in Email, the UUID in Organization UUID, and the key in User Key. Optionally set a Minimum Severity. Each Mend project becomes a Record that you map to a DefectDojo Asset.

Data Granularity: What Gets Imported

The table describes file imports with the Mend Scan parser. The Mend connector creates one Record per Mend project; its field-level mapping is managed by the connector rather than this parser.

Use Cases

In a build pipeline: Every merge to main runs the Unified Agent with the scan report enabled and reimports the JSON into a Test per repository. The team sees which CVEs a dependency bump closed, and new Critical findings can fail a release gate that queries DefectDojo.

When consolidating SCA tools: An organization running Mend alongside another dependency scanner imports both into the same Asset. Reporting covers dependency risk once per application, and SLA timers apply regardless of which scanner found the CVE.

For remediation planning: Because Mend's fix recommendation is in the Mitigation field, an AppSec lead can filter for Findings with a fix available and hand teams a short list of upgrades that close the most risk.

During audits: Discovery dates, SLA status, risk acceptances, and closure dates for third-party CVEs are kept in DefectDojo, which answers the "how long did this stay open" question without reconstructing it from Mend project history.

Operational Tips

• If the connector fails to authenticate, check that Location uses the API base URL for the region your Mend organization is hosted in.
• Use one Test per Mend project and reimport into it. Separate imports work but lose the open-to-mitigated history.
• Every Mend Finding gets CWE 1035, so CWE-based metrics will group all Mend results together. Use component and severity filters instead.
• The parser marks Mend Findings as dynamic rather than static. Keep that in mind if you filter dashboards by finding type.
• On platform output, the vulnerability's publish date is stored in the KEV date field. Don't read that field as a CISA KEV listing date for Mend Findings.
• Titles include the library name, so the same CVE in two libraries produces two Findings. That is usually what you want for remediation.
• Set minimum_severity on import if Low findings from transitive dependencies are drowning out the work that matters, and risk-accept CVEs with no available fix using an expiration date.