Getting Started
Choose your setup path:
Choose Your Path
| Goal | Start here |
|---|---|
| Centrally managed CI/CD builds | Follow the five steps below |
| Centrally reported workloads | Deploy Team Server, enroll a Sensor, then try a local policy |
| Standalone protection | Install a Sensor, then try a local policy without Team Server configuration |
Central policy assignment applies to recognized CI/CD builds. Workloads use local policies.
Before You Begin
Allow access to ghcr.io for images and charts, repo.endurasecurity.com for Sensor packages, and docker.io for the example PostgreSQL image. Centrally managed Sensors need HTTPS access to Team Server. Review provider feed access when using provider selectors.
1. Deploy Team Server
Follow a deployment guide, verify /_readiness, and complete its first-Administrator procedure.
2. Install the Runtime Sensor
Have an Administrator enroll a Sensor, then install it on each protected host. Configure its license, Team Server URL, and token.
Check endura sensor status for connectivity and sudo endura sensor hooks for coverage. Confirm the Sensor appears under Runtime Sensors.
3. Connect a CI/CD Provider
Follow your provider guide to configure discovery and instrument builds. Discover the pipeline before running protected work. Verify that the complete run appears under Pipelines > Builds and cleanup succeeds.
Bamboo, GitHub, GitLab, Jenkins, and TeamCity support managed protection. Koji provides inventory only.
4. Create a Security Policy
Derive, refine, and observe a policy, then assign it to the discovered pipeline. Confirm the effective policy. Enable enforce only after representative runs produce no unexplained violations.
5. Configure Notifications
Configure email, Slack, or Teams for the required pipelines and deployments. Test connectivity, then trigger a controlled violation and verify the alert links to the correct run. Later violation batches can produce additional alerts.
Next Steps
Setup is complete when the Sensor is online, the run is visible, the effective policy is correct, cleanup succeeds, and notification delivery is verified.