Pipeline Security

Pipeline Security applies Runtime Sensor policies to CI/CD builds. It can detect or prevent unexpected file access, execution, network connections, privilege changes, and container activity while a build runs.

How Protection Works

1. Team Server discovers pipelines and builds through a CI/CD integration.
2. The Runtime Sensor runs on the build infrastructure.
3. Build configuration calls endura job start before build work and endura job stop during cleanup.
4. The Sensor evaluates activity against the pipeline’s assigned policy.
5. Team Server records protection state and violations.

Use derive mode to capture a baseline, observe mode to test refinements, and enforce mode to block unauthorized operations. See Security Policies for the complete lifecycle.

Common Threats

• credential and source-code theft;
• malicious or unexpected process execution;
• unauthorized network access;
• container-runtime abuse;
• privilege escalation; and
• cryptomining or other resource abuse.

Protection Status

Build and pipeline protection answer different questions:

• A build status says whether that run was observed and currently has a policy.
• A pipeline status says whether its recent jobs are currently covered.

Builds

A build is Protected when both conditions are true:

1. The Runtime Sensor observed the run after endura job start.
2. The pipeline currently has a security policy assigned.

All other builds are Unprotected. Sensor observation is permanent, but the policy check uses the pipeline’s current assignment. Assigning or removing a policy therefore updates the status of every observed build in that pipeline.

Pipelines

A pipeline is Full, Partial, or None. Team Server groups builds into provider-specific jobs and considers only each job’s latest run inside the Days Until Stale window.

The result is:

Team Server computes the value when a pipeline loads. The Pipelines list filter uses a cached value refreshed by the calculate_statistics scheduler job, so a recently changed pipeline can briefly remain under its previous filter.

Why Builds and Pipelines Can Differ

• Protected builds, None pipeline: The observed builds are older than the stale window.
• Mostly Protected builds, Partial or None pipeline: A job’s newest run was not observed.
• Observed build, Unprotected build status: The pipeline has no policy assigned.

When a latest run is unobserved, verify that the Sensor was online on the selected agent and that the build still called endura job start.

Set Up Pipeline Security

1. Deploy Team Server.
2. Install the Runtime Sensor on build infrastructure.
3. Follow the CI/CD provider guide.
4. Create and refine a policy.