Scan your custom code (SAST) with the Mend CLI

Overview

The Mend CLI Static Application Security Testing (SAST) engine performs an extensive security analysis of application source code, which automates inspection as an alternative to the demanding and time-consuming procedure of manual code reviews.

Use cases for scanning your SAST components with the Mend CLI

Let’s look at the following real-life examples that industry personas commonly run into:

As an AppSec Manager, you are in charge of the decision-making for selecting a tool that can detect custom code weaknesses in your teams' applications and provide remediation suggestions. You also want to define your organization’s policies that can be utilized to control your teams' builds. Finally, you want to monitor the security posture of your organization’s custom code in the form of dashboards.
As a DevOps Engineer, you are tasked with implementing a security tool into your teams' CI/CD solutions that can provide insights on code weaknesses in your teams' applications directly within the pipeline console.

Mend’s Answer: Utilizing the Mend CLI SAST scan, you can effortlessly assess your custom code for security weaknesses and components that violate your organization’s defined policies. The results are conveniently presented in a well-organized table format within the Mend CLI or via dashboards in the Mend SAST Application, and can also be exported into reports in various supported file formats.

Getting It Done

Prerequisites before your Mend CLI SAST scan

The following prerequisites are required before running a Mend CLI SAST scan:
- Download the Mend CLI
- Authenticate your login for the Mend CLI
- Provide the Mend CLI with access to read your application’s source code on a file system

Configure your Mend CLI SAST scan

Configuring the Mend CLI for a SAST scan is done via command line parameters at runtime. To learn more about the SAST-supported languages, available parameters, and CLI exit codes, please visit our Configure the Mend CLI for SAST documentation.

Start your Mend CLI SAST scan

To run the Mend CLI SAST scan on your custom code in the current directory, enter:

CODE

mend sast

The usage of the mend sast command is as follows:

CODE

mend sast [flags]

View the steps of your Mend CLI SAST scan

The Mend CLI has four default steps you will see it complete before it displays its findings from the SAST scan:

Step Name	Description
`Checking`	The Mend CLI confirms if you are on the latest version.
`Updating`	If you are not on the latest version, and auto-updates are enabled, the Mend CLI will update to the latest version.
`Testing`	The Mend CLI tests the application files within the defined directory.
`Analysis`	An analysis is completed on every language detected from the Mend CLI (or the languages defined in your configuration). If any weaknesses are found, the Mend CLI reaches out to the Mend SAST Application for information on these findings to prepare them for the scan summary.

View your Mend CLI SAST scan results

Visit our View the results of your Mend CLI SAST scan article for more details on how to navigate the SAST findings provided by the Mend CLI.

Reference

Mend CLI SAST features

In this article, we cover the instructions on how to kick off a base Mend CLI SAST scan.

However, we also offer examples of the Mend CLI SAST feature(s) in the articles below:

Run an incremental Mend CLI code scan