Discovery of AI Frameworks
Note: This feature is a closed beta and requires a Mend AI entitlement for your organization.
Overview
This article aims to explain how to use AI Frameworks and also touches upon its current limitations.
Prerequisites
A Mend AI entitlement for your organization.
Mend AI discovers AI Frameworks automatically as part of an SCA CLI scan (
mend ua
/mend dep
/mend sca
), however it uses a separate scanner, which must be enabled for automatic AI discovery to take place as part of your SCA scans.
To run an SCA scan, please follow the steps in this article.
Getting it done
Mend AI-enabled organizations in the AppSec Platform are now equipped with default system labels for AI. These labels are essential to the experience of consuming AI Frameworks data provided by Mend AI.
The Steps
Step 1 - Check the relevant AI labels in your organization’s main Security Dashboard.
At this stage, the AppSec Platform will filter the Applications in the dashboard based on the selected labels.
Step 2 - Click the Applications widget.
Step 3 - Click the Labels column on the application you wish to review
Step 4 - You are now taken to the application’s Labels window, where all the AI Frameworks are listed
How Does Mend AI Identify AI Frameworks?
Mend AI searches through the package inventory of your application/project to identify AI frameworks.
This is done in a few ways:
Mend AI flags a specific package, e.g., OpenAI.
Mend AI relies on a set of packages that tells a story about a specific framework.
In more advanced cases, we have a set of AI frameworks that can tell a story about another important framework.
In the case of RAG, in this example, we have a vector database, an embedding model and a generator model.
Limitations
Mend AI is currently supported in the Mend CLI using the
mend ua
,mend dep
andmend sca
commands.
It is not currently supported in repository integrations.No dedicated column/view for the evidence (Roadmap Item)
No organization-level statistics (Roadmap Item)