Mend.io

https://docs.mend.io
Admin
Mend.io is an AppSec platform that provides software composition analysis, static application...
Tokens:1,448,798
Snippets:10,031
Trust Score:10
Update:1 week ago
Show doc for...
Tokens:
Raw
### Example uv virtual environment workflow

Source: https://docs.mend.io/bundle/integrations/page/configure_the_mend_cli_for_sca.html

Example workflow for setting up a virtual environment and synchronizing packages before scanning with uv.

```bash
uv venv --python 3.11.3
uv sync --all-packages
source .venv/bin/activate
```

--------------------------------

### Getting started examples for mend image

Source: https://docs.mend.io/bundle/containers/page/configure_the_mend_cli_for_container_images.html

Provides examples for common use cases: basic scanning, scanning tar format images, adding scope, exporting results in JSON and SBOM formats, and filtering output by severity or excluding base layers.

```bash
# Getting started quickly
mend image <image:tag>

# Scanning tar format images
mend image myimage.tar --tar

# Adding Scope to the scanned image (To be reflected in Mend UI)
mend image <image:tag> --scope "*//Test-Application//MyProject"


# export results via the CLI
## json export
mend image <image:tag> --format json --filename ./image_results.json

## sbom (spdx-json) export
mend image <image:tag> --format spdx-json --filename ./image_results_sbom.json


# CLI Output filtering (terminal output only)
## filter by severity
mend image <image:tag> --filter critical,high

## filter out base layers
mend image <image:tag> --exclude-base-layers

```

--------------------------------

### Sample repo-config.json/.whitesource file

Source: https://docs.mend.io/integrations/latest/least-vulnerable-packages-feature.md

Full example configuration file showing all settings blocks, including 'leastVulnerablePackageSettings' with 'enabled': true.

```json
{ 
      "scanSettings": {
        "configMode": "AUTO",
        "configExternalURL": "",
        "projectToken": "",
        "baseBranches": [],
        "enableLicenseViolations": "true"
      },
      "checkRunSettings": {
        "vulnerableCheckRunConclusionLevel": "failure",
        "displayMode": "diff",
        "useMendCheckNames": true
      },
      "issueSettings": {
        "minSeverityLevel": "LOW",
        "issueType": "DEPENDENCY"
      },
      "remediateSettings": {
        "workflowRules": {
          "enabled": true,
          "minVulnerabilitySeverity": "LOW"
        },
        "extends": ["mergeConfidence:all-badges"]
      },
      "leastVulnerablePackageSettings": {                 
        "enabled": true     
      } 
    }
```

--------------------------------

### Get Images API Response Example

Source: https://docs.mend.io/wsk/container-image-api-2-0-use-with-postman.md

Example response from the Get Images API request showing pagination metadata and a scanned image with vulnerability statistics.

```json
{
        "additionalInfo": {
            "page": 0,
            "size": 1000,
            "pageCount": 1,
            "totalCount": 1,
            "totalItems": 1,
            "isLastPage": true
        },
        "data": [
            {
                "repo": "vulnerables/web-dvwa",
                "registry": "docker hub",
                "repoId": 0,
                "distributionId": 0,
                "uuid": "cad52219-a87c-4953-8623-42a07c75395d",
                "sha256": "sha256:ab0d83586b6e8799bb549ab91914402e47e3bcc7eea0c5cdf43755d56150cc6a",
                "tag": "latest",
                "size": 4096,
                "layersCount": 8,
                "architecture": "amd64",
                "pushDate": "2018-10-12T17:49:01Z",
                "maxRiskScore": 7.8,
                "os": "DEBIAN",
                "risk": 7.8,
                "osVersion": "9.2",
                "isDeployed": false,
                "firstScanDate": "2023-05-02T19:53:03.697Z",
                "lastScanDate": "2023-05-02T19:53:32.565Z",
                "policyViolationsCount": 0,
                "vulnerabilitiesStats": {
                    "total": 1717,
                    "critical": 265,
                    "high": 612,
                    "medium": 657,
                    "low": 161,
                    "unknown": 22
                }
            }
        ]
    }
```

--------------------------------

### Download target configuration examples

Source: https://docs.mend.io/platform/latest/manage-red-teaming-via-mend-cli.md

Examples of downloading a target configuration by name or by ID with verbose output. The output file is in YAML format and contains target connection configuration, settings, and enabled probes.

```bash
# Download by target name
mend ai redteam download \
  --target-name "Insurance Chatbot - Production" \
  --file insurance-chatbot-config.yaml
```

```bash
# Download by target ID with verbose output
mend ai redteam download \
  --target-id "f21b9c82-9f52-4659-98a1-6f86ed041d0a" \
  --file config.yaml \
  --verbose
```

--------------------------------

### Get Alerts - Organization Response Example

Source: https://docs.mend.io/bundle/api_sca/page/alerts_api.html

Example response for the Get Alerts - Organization API. Returns a JSON collection of all alerts in the organization, including alert type, level, and library details. The example is truncated with ellipsis in the source.

```json
{
    "alerts": [
        {
            "type": "REJECTED_BY_POLICY_RESOURCE",
            "level": "MAJOR",
            "library": {
                "keyUuid": "3c0f701b-1315-43ed-b94b-a14447f46a4a",
                "keyId": 36637701,
                "filename": "ini-1.3.5.tgz",
                "type": "javascript/Node.js",
                "languages": "javascript/Node.js",
                "description": "An ini encoder/decoder for node",
                "references": {
                    "url": "https://registry.npmjs.org/ini/-/ini-1.3.5.tgz",
                    "homePage": "https://github.com/isaacs/ini#readme",
                    "genericPackageIndex": "https://www.npmjs.org/package/ini"
                },
                "sha1": "eee25f56db1c9ec6085e0c22778083f596abf927",
                "name": "ini",
                "artifactId": "ini-1.3.5.tgz",
                "version": "1.3.5",
                "groupId": "ini",
                "licenses": [
                    {
                        "name": "ISC",
                        "spdxName": "ISC",
                        "url": "http://www.opensource.org/licenses/ISC",
                        "profileInfo": {
                            "copyrightRiskScore": "THREE",
                            "patentRiskScore": "THREE",
                            "copyleft": "NO",
                            "linking": "NON_VIRAL",
                            "royaltyFree": "NO"
                        },
                       ...........
```

--------------------------------

### Example for Nuget project using Linux pipeline

Source: https://docs.mend.io/wsk/scanning-in-an-azure-devops-pipeline-prioritize.md

Shows how to set variables for the binary target location and run the scan for a Nuget project on a Linux pipeline.

```bash
CSPROJ=$(basename $(find ./src -type f -wholename "*.csproj") .csproj)
DLL=$(find ./ -type f -wholename "*/bin/Release/*/$CSPROJ.dll")

java -jar wss-unified-agent.jar -appPath <path to publish dll> -d /projectFolder
```

--------------------------------

### Get Project Alerts Response Example

Source: https://docs.mend.io/bundle/api_sca/page/alerts_api.html

Example response for the Get Alerts - Project API. Returns a JSON collection of all alerts for the project, including vulnerability details, fixes, and threat assessment.

```json
{
    "alerts":
    [
        {
            "vulnerability":
            {
                "name": "CVE-2016-3674",
                "type": "CVE",
                "severity": "medium",
                "score": 5.0,
                "cvss3_severity": "high",
                "cvss3_score": 7.5,
                "scoreMetadataVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                "publishDate": "2016-05-17",
                "lastUpdated": "2018-03-26",
                "url": "https://www.mend.io/vulnerability-database/CVE-2016-3674",
                "description": "Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2) DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver, (6) StandardStaxDriver, and (7) WstxDriver drivers in XStream before 1.4.9 allow remote attackers to read arbitrary files via a crafted XML document.",
                "topFix":
                {
                    "vulnerability": "CVE-2016-3674",
                    "type": "UPGRADE_VERSION",
                    "origin": "WHITESOURCE_EXPERT",
                    "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3674",
                    "fixResolution": "1.4.9",
                    "date": "2016-05-17",
                    "message": "Upgrade to version"
                },
                "allFixes":
                [
                    {
                        "vulnerability": "CVE-2016-3674",
                        "type": "UPGRADE_VERSION",
                        "origin": "WHITESOURCE_EXPERT",
                        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3674",
                        "fixResolution": "1.4.9",
                        "date": "2016-05-17",
                        "message": "Upgrade to version"
                    },
                    {
                        "vulnerability": "CVE-2016-3674",
                        "type": "UPGRADE_VERSION",
                        "origin": "SECURITY_TRACKER",
                        "url": "http://www.securitytracker.com/id/1036419",
                        "fixResolution": "IBM has issued a fix (8.53 FP6 Interim Fix 14, 9.01 FP6 Interim Fix 2).\n\nThe IBM advisory is available at:\n\nhttp://www-01.ibm.com/support/docview.wss?uid=swg21985960",
                        "message": "IBM Lotus Domino XML External Entity Processing Flaw in XStream Lets Remote Users Obtain Potentially Sensitive Information"
                    }
                ],
                "fixResolutionText": "Upgrade to version 1.4.9",
                "threatAssessment":
                {
                    "exploitCodeMaturity": "NOT_DEFINED",
                    "epssPercentage": 0.2
                },
                "references":
                []
            },
...........
}
```

--------------------------------

### Get Product Alerts Response Example

Source: https://docs.mend.io/bundle/api_sca/page/alerts_api.html

Example response for the Get Alerts - Product API. Returns a JSON collection of alerts, each containing type, level, and library details such as keyUuid, filename, version, and license information. The response is truncated in the source with "...........".

```json
{
    "alerts": [
        {
            "type": "REJECTED_BY_POLICY_RESOURCE",
            "level": "MAJOR",
            "library": {
                "keyUuid": "c147bc0a-41f9-4867-b056-b4fc8a7dbac4",
                "keyId": 66142625,
                "filename": "Pillow-5.2.0.tar.gz",
                "type": "Python",
                "languages": "Python",
                "description": "Python Imaging Library (Fork)",
                "references": {
                    "url": "https://files.pythonhosted.org/packages/d3/c4/b45b9c0d549f482dd072055e2d3ced88f3b977f7b87c7a990228b20e7da1/Pillow-5.2.0.tar.gz",
                    "homePage": "https://python-pillow.org",
                    "genericPackageIndex": "https://pypi.python.org/pypi/Pillow/5.2.0"
                },
                "sha1": "7d0f97e23425418f2e4c9ee51fc3bcb9ee71ec60",
                "name": "Pillow",
                "artifactId": "Pillow-5.2.0.tar.gz",
                "version": "5.2.0",
                "groupId": "Pillow",
                "licenses": [
                    {
                        "name": "PIL Software License",
                        "url": "http://www.pythonware.com/products/pil/license.htm",
                        "references": [
                            {
                                "referenceType": "Project home page",
                                "reference": "https://github.com/python-pillow/Pillow/blob/master/LICENSE"
                            }
                        ]
                    }
                ]
             ...........                       
```

--------------------------------

### Recommended starting config with config:recommended preset

Source: https://docs.mend.io/bundle/integrations/page/mend_remediate_and_renovate.html

Recommended starting configuration for new Renovate users. Enables the config:recommended preset, which includes features like maximum two dependency update PRs per hour and grouping well-known monorepo dependencies.

```json
{
  "remediateSettings": {
    "enableRenovate": true,
    "extends": ["config:recommended"]
  }
}
```

--------------------------------

### Example manual Docker build commands with version 19.5.2

Source: https://docs.mend.io/integrations/latest/deploy-mend-github-enterprise-container-images.md

Example commands showing how to build all images including the dedicated SAST image with a specific version tag (19.5.2).

```bash
# For example:
docker build -t wss-ghe-app:19.5.2 wss-ghe-app/docker
docker build -t wss-scanner:19.5.2 wss-scanner/docker
docker build -t wss-scanner-sast:19.5.2 wss-scanner-sast/docker
docker build -t wss-remediate:19.5.2 wss-remediate/docker
```

--------------------------------

### Get Ignored Alerts - Organization Request

Source: https://docs.mend.io/bundle/api_sca/page/alerts_api.html

Request example for the Get Ignored Alerts - Organization API. Requires requestType, userKey, and orgToken parameters.

```json
{
    "requestType" : "getOrganizationIgnoredAlerts",
    "userKey":"user_key",
    "orgToken":"organization_api_key" 
}
```
Tokens:
Raw