tutorial

Monitoring Mend (WhiteSource) SCA Pipelines with Vigilmon: Detect Silent Security Scan Failures

Use Vigilmon heartbeat monitors to catch silent failures in Mend software composition analysis scans — broken pipelines, missed dependency checks, and scans that stop running.

Your Mend software composition analysis scan hasn't run in 11 days. A critical CVE was published for a dependency your application uses. Because the scan stopped running after a CI refactor silently dropped the scan step, nobody on your team got the Mend alert. The vulnerability shipped to production.

Mend (formerly WhiteSource) is a powerful SCA and security platform, but like any CI-integrated tool, it can stop running without anyone noticing. This tutorial shows you how to use Vigilmon heartbeat monitors to detect silent Mend scan failures before they create security blind spots.

What You'll Cover

  • Heartbeat monitoring for scheduled Mend SCA scans
  • Detecting scans that stop running after CI changes
  • Monitoring Mend's own availability and API endpoints
  • Multi-project scan coverage verification
  • Alert routing for security scan failures

Prerequisites

  • A Mend account with at least one project configured for scanning
  • CI/CD pipeline running Mend scans (GitHub Actions, GitLab CI, Jenkins, or similar)
  • A free account at vigilmon.online

The Problem: When Security Scans Stop Running

Mend sends alerts when it finds vulnerabilities — but it can only send alerts if it's running. Silent scan failures happen when:

  • A CI pipeline is refactored and the Mend scan step is accidentally removed
  • A Mend API token expires and the scan step fails but is misconfigured to ignore errors
  • A scheduled scan job fails to start (wrong credentials, org ID changed)
  • A branch is renamed and the CI trigger no longer matches
  • The Mend agent can't reach the Mend servers due to network changes

In all these cases, Mend produces no alert — because from Mend's perspective, it simply wasn't called. Vigilmon's heartbeat pattern fills this gap: your scan pipeline pings a URL on successful completion, and if that ping doesn't arrive within the expected window, you get alerted.

Step 1: Create a Heartbeat Monitor in Vigilmon

  1. Log in to Vigilmon and click New Monitor → Heartbeat.
  2. Name it to reflect the scan it covers, e.g., Mend SCA — backend-api (weekly).
  3. Set the Expected interval to match your scan schedule:
    • Daily scans: 25 hours (adds a 1-hour buffer)
    • Weekly scans: 8 days
    • Per-PR scans: Not well suited to heartbeats — use Mend's own PR blocking instead
  4. Set the Grace period to 2 hours for daily scans, 12 hours for weekly.
  5. Save and copy the Ping URL — it looks like https://vigilmon.online/api/heartbeat/<unique-id>.

Step 2: Add Heartbeat Pings to GitHub Actions

Here's a complete GitHub Actions workflow that runs Mend and pings Vigilmon on success:

# .github/workflows/mend-scan.yml
name: Mend SCA Scan

on:
  schedule:
    - cron: "0 3 * * 1"  # every Monday at 03:00 UTC
  push:
    branches: [main]
  workflow_dispatch:

jobs:
  mend-scan:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - name: Set up Java
        uses: actions/setup-java@v4
        with:
          java-version: "17"
          distribution: "temurin"

      - name: Download Mend Unified Agent
        run: |
          curl -LO https://unified-agent.s3.amazonaws.com/wss-unified-agent.jar

      - name: Run Mend SCA scan
        env:
          WS_APIKEY: ${{ secrets.MEND_API_KEY }}
          WS_USERKEY: ${{ secrets.MEND_USER_KEY }}
          WS_WSS_URL: ${{ secrets.MEND_SERVER_URL }}
          WS_PRODUCTNAME: "MyProduct"
          WS_PROJECTNAME: "backend-api"
        run: |
          java -jar wss-unified-agent.jar

      - name: Ping Vigilmon heartbeat
        if: success()
        run: |
          curl -fsS -X POST "${{ secrets.VIGILMON_MEND_SCAN_URL }}" \
            --max-time 10 \
            --retry 3 \
            --retry-delay 2

The if: success() condition ensures the heartbeat is only sent when the Mend scan completes without errors. If the scan step fails for any reason — expired credentials, missing dependency file, network error — no ping is sent and Vigilmon alerts you after the grace period.

Store the Vigilmon secret

In your GitHub repo, go to Settings → Secrets and variables → Actions → New repository secret:

  • Name: VIGILMON_MEND_SCAN_URL
  • Value: the ping URL from Step 1

Step 3: GitLab CI Integration

For GitLab CI pipelines, add the heartbeat ping as a final stage:

# .gitlab-ci.yml
stages:
  - test
  - security
  - notify

mend-sca-scan:
  stage: security
  image: openjdk:17-slim
  script:
    - curl -LO https://unified-agent.s3.amazonaws.com/wss-unified-agent.jar
    - >
      java -jar wss-unified-agent.jar
      -apiKey "$MEND_API_KEY"
      -userKey "$MEND_USER_KEY"
      -wss.url "$MEND_SERVER_URL"
      -product "MyProduct"
      -project "backend-api"
  only:
    - schedules
    - main

mend-heartbeat:
  stage: notify
  script:
    - >
      curl -fsS -X POST "$VIGILMON_MEND_SCAN_URL"
      --max-time 10
      --retry 3
  when: on_success
  needs: ["mend-sca-scan"]
  only:
    - schedules
    - main

The when: on_success and needs: ["mend-sca-scan"] combination ensures the heartbeat only fires when the scan job succeeds.

Step 4: Monitor the Mend API Endpoint

Beyond scan pipeline monitoring, you can monitor Mend's own API availability. If Mend's servers are unreachable, your scans will fail — and you want to know whether the failure is on your side or theirs.

  1. In Vigilmon, click New Monitor → HTTP.
  2. Set the URL to Mend's API health endpoint (check your Mend region URL — typically https://saas.mend.io or your dedicated server URL).
  3. Set the check interval to every 5 minutes.
  4. Name it Mend API — saas.mend.io.

Now when your scan pipeline fails, you can immediately tell whether Mend is down globally or whether there's a configuration issue in your pipeline.

Step 5: Monitor Multiple Projects

Large organizations run Mend scans across many repositories. Create one heartbeat monitor per project and use a naming convention that makes it easy to scan the Vigilmon dashboard:

| Project | Schedule | Monitor name | Interval | |---|---|---|---| | backend-api | Weekly | Mend — backend-api | 8 days | | frontend-app | Weekly | Mend — frontend-app | 8 days | | mobile-sdk | Bi-weekly | Mend — mobile-sdk | 15 days | | infrastructure | Monthly | Mend — infrastructure | 32 days |

Group these monitors under a Status Page in Vigilmon so stakeholders can see SCA coverage health at a glance.

Step 6: Jenkins Integration

For Jenkins-based Mend pipelines, add the heartbeat ping to a post { success { ... } } block:

// Jenkinsfile
pipeline {
    agent any

    triggers {
        cron('H 3 * * 1')  // weekly on Monday
    }

    environment {
        WS_APIKEY = credentials('mend-api-key')
        WS_USERKEY = credentials('mend-user-key')
        VIGILMON_MEND_URL = credentials('vigilmon-mend-scan-url')
    }

    stages {
        stage('Checkout') {
            steps {
                checkout scm
            }
        }

        stage('Mend SCA Scan') {
            steps {
                sh '''
                    curl -LO https://unified-agent.s3.amazonaws.com/wss-unified-agent.jar
                    java -jar wss-unified-agent.jar \
                        -apiKey "$WS_APIKEY" \
                        -userKey "$WS_USERKEY" \
                        -product "MyProduct" \
                        -project "backend-api"
                '''
            }
        }
    }

    post {
        success {
            sh '''
                curl -fsS -X POST "$VIGILMON_MEND_URL" \
                    --max-time 10 \
                    --retry 3
            '''
        }
    }
}

Step 7: Configure Alert Channels

In Vigilmon, go to Notifications → New Channel and configure:

  • Email — immediate alert to the security team distribution list
  • Slack webhook — post to #security-alerts
  • PagerDuty — for critical production security scan gaps

Route Mend heartbeat alerts to a dedicated security channel rather than your general ops channel. Security scan failures warrant faster triage than most infrastructure alerts.

When a Mend scan stops running:

🔴 MISSED HEARTBEAT: Mend — backend-api
Last ping: 9 days ago
Expected interval: 7 days

This tells your security team that the backend-api project has a 9-day gap in vulnerability coverage — actionable before it becomes a compliance finding.

What You're Now Catching

| Silent failure mode | How Vigilmon detects it | |---|---| | CI step removed after pipeline refactor | No ping → alert after grace period | | Mend API token expired silently | Scan fails, no ping sent → alert | | Mend servers unreachable | HTTP monitor detects downtime | | Branch rename drops CI trigger | Scan never runs → no ping → alert | | Schedule job fails to start | No ping within interval → alert | | Scan runs but exits non-zero silently | if: success() prevents ping → alert |

Mend is only effective when it's running. A vulnerability scanner that silently stops scanning is worse than no scanner — it creates false confidence. Vigilmon's heartbeat monitors give your security team the signal they need when Mend scans fall off the schedule.

Start monitoring your Mend SCA pipelines today — register free at vigilmon.online.

Monitor your app with Vigilmon

Free plan — 5 monitors, no credit card required. Up and running in 60 seconds.

Start free →
← Back to all articles