Monitor SCA projects

Notify teams about new vulnerabilities in watched projects or configure webhooks to receive notifications for project events.

Get notifications for watched projects

Teams assigned to a workspace that contains a watched project can get notified about new vulnerabilities in the project.

Before you begin:

You must have the Security Lead, Workspace Administrator, or Workspace Editor role.

To complete this task:

1. In the Veracode Platform, select Scans & Analysis > Software Composition Analysis.
2. Select Agent-Based Scan.
3. Select Agent-Based Scan Settings.
4. Select Email me about issues created or changed due to new vulnerability releases in any of my projects that I am watching.

Get notifications for project events

Create webhooks that send events about your projects. When the event triggers, the SCA agent sends an HTTP POST request with a payload to your configured URL. Your receiving system must be able to accept custom payloads.

Webhook event triggers

The following events can trigger notifications.

Event	Description
Scan	Veracode successfully scans project.
Vulnerability issues discovered in project library after a scan	The Veracode research team releases a new vulnerability that affects your project
Vulnerability issues changed in project library after a scan	The Veracode research team updates a vulnerability that affects your project

Add a webhook to a project

You can configure the payload URL and trigger events of the webhook notifications for your SCA projects.

Before you begin:

You must have the Security Lead, Workspace Administrator, or Workspace Editor role.

To complete this task:

1. In the Veracode Platform, select Scans & Analysis > Software Composition Analysis.
2. Select Agent-Based Scan.
3. Select a workspace.
4. Select Projects.
5. Select a project.
6. Select Settings.
7. Select Notifications.
8. Select Actions > Create.
9. Enter your payload URL. The payload URL must be accessible from the internet and accept HTTP HEAD requests.
10. Select the trigger events for which you want to receive notifications.
11. Select Create.

Webhook payload examples

Each trigger event generates a particular type of payload with the relevant information. These examples show the content that the SCA agent sends for each event.

Scan success

    {
      "event": "SCAN_SUCCESS",
      "organization": {
        "id": 310,
        "name": "Veracode",
        "planType": "ENTERPRISE"
      },
      "workspace": {
        "id": 4788,
        "name": "Webhooks"
      },
      "user": {
        "id": 2910,
        "name": "John Smith"
      },
      "scan": {
        "id": 1099430,
        "commit": "2bedd63b8e3019121c89108bfccb2421b08e28e9",
        "branch": "New_demo_branch",
        "tag": null,
        "reportLink": "<LINK TO REPORT>",
        "vulnIssuesCount": 31,
        "outofDateIssuesCount": 9,
        "licenseIssuesCount": 0
      },
      "project": {
        "id": 20757,
        "name": "example-javascript"
      }
    }

Vulnerability issues discovered

    {
      "event": "VULN_ISSUES_DISCOVERED_AFTER_SCAN",
      "organization": {
        "id": 310,
        "name": "Veracode",
        "planType": "ENTERPRISE"
      },
      "workspace": {
        "id": 4788,
        "name": "Webhooks"
      },
      "user": null,
      "issues": [
        {
          "id": 111967,
          "status": "NEW",
          "issueUrl": "<LINK TO ISSUE>",
          "vuln": {
            "id": 16462,
            "title": “Title of vulnerability",
            "cvssScore": 4.3,
            "cvss3Score": 5.9,
            "cve": null,
            "cveStatus": "NA",
            "stage": "RELEASED",
            "disclosureDate": null,
            "hasExploits": false,
            "vulnerabilityTypes": [],
            "overview": null
          }
        }
      ],
      "project": {
        "id": 20757,
        "name": "example-javascript"
      }
    }

Vulnerability issues changed

    {
      "event": "VULN_ISSUES_CHANGED_AFTER_SCAN",
      "organization": {
        "id": 310,
        "name": "Veracode",
        "planType": "ENTERPRISE"
      },
      "workspace": {
        "id": 4788,
        "name": "Webhooks"
      },
      "user": null,
      "issues": [
        {
          "id": 111967,
          "status": "RESOLVED",
          "issueUrl": “<LINK TO ISSUE>”,
          "vuln": {
            "id": 16462,
            "title": "Title of vulnerability",
            "cvssScore": 7.8,
            "cvss3Score": 5.9,
            "cve": null,
            "cveStatus": "NA",
            "stage": "RELEASED",
            "disclosureDate": null,
            "hasExploits": false,
            "vulnerabilityTypes": [],
            "overview": null
          }
        }
      ],
      "project": {
        "id": 20757,
        "name": "example-javascript"
      }
     }