Bamboo

Connect Bamboo to Team Server, install the Sensor on every build agent, and instrument each protected job with a start task and final stop task.

Object Mapping

One Bamboo project is one Team Server pipeline. A three-job plan produces three builds per run, identified by stable job key and build number. Every plan and job in the project shares one policy. Team Server must discover the project before Sensor-reported jobs can attach to it.

Prerequisites

• Operator or Administrator access to Team Server
• Bamboo access that can create a personal access token and edit plans
• Root access to local and remote agent hosts

Configure the Integration

Create a Token

Use a dedicated Bamboo service account with read-only access to the projects Team Server should discover. Under the account profile, open Personal access tokens, create a token with an expiration and rotation owner, and store the value in a secrets manager.

Add Bamboo to Team Server

1. Open Integrations, then Bamboo under Discover.
2. Select Get Started or Create.
3. Enter the Bamboo base URL and token.
4. Select Test, then Save.

Discovered projects appear under Pipelines. Create separate integrations for separate Bamboo instances or credentials. For a private address or internal CA, configure Team Server outbound HTTP policy.

Schedule Discovery

Add these jobs to scheduler.jobs:

discover_bamboo_pipelines:
  run: "discover_bamboo_pipelines"
  schedule: "0 0 * * * * *"
discover_bamboo_builds:
  run: "discover_bamboo_builds"
  schedule: "0 */15 * * * * *"

Keep calculate_statistics and update_status enabled. Restart Team Server after changing configuration; see Scheduler.

Install the Sensor on Agents

Install the Sensor on every local, remote, elastic, or autoscaled agent that can run a protected job. Include Sensor installation in agent images or provisioning. See Runtime Sensor deployment.

If Bamboo uses capabilities or dedicated agents for protected plans, confirm that every matching agent reports online in Team Server.

Instrument a Job

A Bamboo plan contains stages, jobs, and tasks. Instrument each job that performs protected work.

Start Task

Under the job’s Tasks, add a Script task as the first task:

export BUILD_BRANCH="${bamboo.planRepository.branchName}"
export BUILD_TRIGGERED_BY="${bamboo.ManualBuildTriggerReason.userName}"
endura job start

BUILD_TRIGGERED_BY resolves for manual runs. For other trigger types, map a plan or global variable that identifies the trigger when available.

Final Stop Task

Under Final tasks, add a Script task:

endura job stop

A final task runs after regular tasks fail, which is required for job cleanup and derived-policy output.

Bamboo Specs

Use repository-stored Bamboo Specs to standardize the tasks:

version: 2
plan:
  project-key: PROJ
  key: BUILD
  name: Example Build
stages:
  - Build:
      jobs:
        - Build
Build:
  tasks:
    - script:
        description: Start Endura Job
        interpreter: SHELL
        scripts:
          - |
            export BUILD_BRANCH="${bamboo.planRepository.branchName}"
            export BUILD_TRIGGERED_BY="${bamboo.ManualBuildTriggerReason.userName}"
            endura job start
    # Existing build tasks follow.
  final-tasks:
    - script:
        description: Stop Endura Job
        interpreter: SHELL
        scripts:
          - endura job stop

Apply the same pattern to every job defined by the Specs.

Container Jobs

When Bamboo runs the job in Docker, the Sensor remains on the agent host. Add this Docker volume argument:

--volume /run/endura/sensor.sock:/run/endura/sensor.sock

Install the CLI in the first task before starting the job:

curl -sSf https://repo.endurasecurity.com/install/endura-sensor/testing.sh | sh
export BUILD_BRANCH="${bamboo.planRepository.branchName}"
export BUILD_TRIGGERED_BY="${bamboo.ManualBuildTriggerReason.userName}"
endura job start

Keep endura job stop as a final task. Without the socket mount, the CLI cannot reach the host Sensor.

Multi-job Plans

• Instrument each job that performs build work, even when jobs run on different agents.
• Each job execution is a separate Team Server build.
• All plans and jobs in a Bamboo project share one policy.
• Run the entire plan while deriving so every job contributes valid behavior.
• Split plans into separate Bamboo projects when they require different policies.

Verify

1. Run the complete plan.
2. Open the Bamboo project under Pipelines in Team Server.
3. Confirm each instrumented job appears under Builds.
4. If a build is missing, check project discovery, agent Sensor status, task order, and final-task logs.

Create and Assign a Policy

1. Run representative plans without an assigned policy to derive behavior.
2. Copy the policy printed by the final endura job stop task.
3. Create a Team Server policy in observe mode.
4. Assign it to the Bamboo project pipeline.
5. Refine across all plan and job types, then change it to enforce.

See Security Policies for the complete lifecycle. Configure Slack after violations are reaching Team Server.