Mend (Formerly known as Whitesource) Integration with DefectDojo
Mend (formerly WhiteSource) is a comprehensive application security platform that provides software composition analysis (SCA), static application security testing (SAST), container security, and AI security capabilities to identify vulnerabilities, license compliance risks, and security flaws across open-source components, proprietary code, container images, and AI-driven applications throughout the software development lifecycle. The platform delivers real-time vulnerability detection with reachability analysis to prioritize exploitable risks, automated SBOM generation in SPDX and CycloneDX formats, continuous monitoring of newly disclosed vulnerabilities, and seamless integration into CI/CD pipelines and developer workflows to enable proactive risk management while reducing remediation time by up to 80%.
Data Granularity: What Gets Imported
The following fields are captured from Mend (Formerly known as Whitesource) results and surfaced in DefectDojo findings:
| Field | Source | Notes |
|---|---|---|
| Title | Finding name from the scan | Matched to the tool's own naming |
| Severity | Critical / High / Medium / Low / Info | Mapped from the tool's own severity scale |
| Description | Finding detail from the report | Includes what the issue is and why it matters |
| Mitigation | Remediation guidance | Where the tool provides it |
Importing Into DefectDojo
Use the DefectDojo import API to create a new Test under the relevant Engagement for your product. The request body:
{
"scan_type": "Mend (Formerly known as Whitesource)",
"engagement": "<engagement-id>",
"file": "results.json"
}