Mend SCA

Invicti ASPM supports Mend (formerly WhiteSource) as an SCA (Software Composition Analysis) scanner. This guide explains how to activate and configure the Mend integration.

Mend is an enterprise-grade software composition analysis platform that helps organizations manage open-source security, license compliance, and code quality risks. It provides continuous monitoring of open-source components and automated policy enforcement.

Important: This Mend SCA integration works with API v2 (/api/v2.0). Ensure your Mend instance supports the v2 API before configuring this integration.

Prerequisites:

Before starting the integration, ensure you have the following information from your Mend account:

❗️

Admin or Manager role recommended.

How to Get Credentials (on Mend Side)

1. Log in to your Mend account.
2. Navigate to Administration > Integration to find the organization API Key.
3. Go to your Profile settings to find your User Key.
4. Your Username is the email address associated with your Mend account.
5. The URL is your Mend instance base URL (e.g., https://saas.mend.io for SaaS or your on-premises URL).

Obtaining User Key:

To obtain a User Key, you need to access the Mend SCA platform and navigate through your user profile settings. Follow these steps:

1. Login to Mend SCA platform at White Source Software Website.
2. Click on your user profile icon in the top right corner of the screen
3. Select My Profile from the dropdown menu

Once you're on the Profile page, you'll see several tabs in the left sidebar. The User Keys section is where you can manage all your API authentication keys.

1. Locate the left sidebar menu on the Profile page
2. Find and click on the User Keys tab
3. The User Keys page will display all your existing keys and creation options

Creating a new User Key is straightforward. Each key can be labeled with a description to help you identify its purpose.

1. On the User Keys page, click the "Create User Key" button located in the top right corner
2. Enter a meaningful description for the key (e.g., 'Invicti ASPM Integration' )
3. Click confirm to generate the key
4. Copy and securely store the generated User Key immediately

❗️

The User Key will be displayed only once. If you lose it, you must create a new key and update all integrations. Store it in a secure password manager or key vault immediately.

Step 1: Navigate to Integrations

From the left sidebar menu, click on Integrations.

Step 2: Select the SCA Tab

On the Integrations page, you will see the Scanners section with multiple tabs. Click on the SCA tab.

Step 3: Find and Activate Mend

Scroll through the list of SCA scanners to find Mend.

• If Mend is not activated, you will see an "Activate" button. Click it to enable the integration.
• If Mend is already activated, you will see a toggle switch in the ON position and a "Deactivate" button, along with a gear icon for configuration.

Note: The scan method badge on the Mend card shows KDT, which means scans are triggered through the Kondukto CLI tool (KDT).

Step 4: Configure Connection Settings

Click on the gear icon on the Mend card to open the configuration panel.

Info: This Mend SCA integration works with API v2 (/api/v2.0).

Fill in the required fields:

1. Username: Enter your Mend account email address.
2. User Key: Paste your Mend user key.
3. Api Key: Paste the organization API key from your Mend account.
4. URL: Enter your Mend instance URL (e.g., https://saas.mend.io).
5. Insecure: Enable this checkbox only if your Mend instance uses a self-signed SSL certificate.

Step 5: Test the Connection

Click the "Test Connection" button at the bottom of the configuration panel to verify that the provided credentials and URL are correct.

• If the connection is successful, the integration is ready to use.
• If the connection fails, verify your Username, User Key, Api Key, and URL values.
• For existing integrations, you can use the "Retest Connection" button at the top of the panel.

Step 6: Advanced Settings (Optional)

Click on "Advanced Settings" to expand additional options:

After modifying advanced settings, click "Save Advanced Settings" to apply changes.

Summary