Mend
Summary
Mend is an automated application security and remediation platform. It can be used to drive insights into static & software composition analysis.
Setup
In order to connect Cortex to your Mend instance, you’ll need to create an API token, and add it under Settings → Mend. Additionally, you'll need your organization name, which can be found in the SAST interface under Administration → Organizations.
If you do not see the Settings page you're looking for in the sidebar, you likely don't have the proper permissions and need to contact your admin.
We route our requests through a static IP address. Reach out to support at help@cortex.io to receive details about our static IP. If you're unable to directly whitelist our static IP, you can route requests through a secondary proxy in your network that has this IP whitelisted, and have that proxy route traffic to your Mend instance.
Advanced Configuration
If you’re unable to expose your Mend instance to be reachable by Cortex, you can set up a Custom Integration Webhook.
Registration
Discovery
By default, Cortex will use your associated Git repository (e.g. repo-name
) as the "best guess" for the Mend application name.
If your repository names don’t cleanly match the Mend application names, you can override this in the Cortex Service Descriptor.
Catalog Descriptor
If you need to override the automatic discovery, you can define the following block in your Cortex Catalog Descriptor.
x-cortex-static-analysis:
mend:
applicationIds:
- mend_id_1
- mend_id_2
These application IDs can be found in the Mend SAST web interface.