View the results of the Mend for Azure Repos IaC scan

Overview

Once your Mend for Azure Repos IaC scan has been completed, multiple resources are provided to help you review your results.

Mend IaC Check

Once the Mend for Azure Repos IaC scan is completed, the Mend IaC Check is updated with an IaC Report that provides an overview of the IaC violations found:

Violation Details: Recommendation information to correct the IaC violation
File Type: Type of file impacted by the IaC violation
File: Directory, file, and code line(s) where the IaC violation is located

The Mend IaC Check also includes a Scan token, which you can provide to Mend Support for troubleshooting.

Azure Repos Work Item

The Work Items section displays all the issues that Mend IaC Scan detected with the IaC Violation tag and a tag indicating a repository in which the issue was found. These proprietary labels indicate that a security vulnerability was detected by Mend.
The created Work Item type depends on the Process that was used in the project, as follows:

Basic, Agile, and CMMI: Issue
Scrum: Impediment

You can also create Area paths to group Work Items by team, product, or feature. This can be configured via the parameter customFields within the issueSettings configuration. Here’s an example of setting the area path:

CODE

"customFields": {
"Area Path": "test-2\\Area1\\SubArea1"
}

Notes:

Work items that were manually closed will not be re-opened during future Mend scans unless their tag and/or name have been changed.
As part of your workflow, you have the option to manually add a relevant tag(s) to specific work items, and close work items that were resolved.