GitLab

Connect GitLab to Team Server, place the Sensor on the runner, and bracket each protected CI job with Endura commands.

Object Mapping

GitLab	Team Server
Group	Discovery scope
Project	Pipeline
CI job	Build

A GitLab pipeline containing five jobs produces five Team Server builds under one project pipeline. Every job in the project shares the project’s assigned policy. Team Server must discover the project before Sensor-reported jobs can attach to it.

Prerequisites

Operator or Administrator access to Team Server
GitLab group access that can create a read token
Permission to edit .gitlab-ci.yml
Root access to self-managed runner hosts
For GitLab-managed runners, an Endura license and Sensor token stored as protected CI/CD variables

Configure the Integration

Create a Token

Use a dedicated service account or group access token with read access to the groups and projects you want to monitor. Grant the read_api scope, set an expiration and rotation owner, and store the value in a secrets manager.

Add GitLab to Team Server

Open Integrations, then GitLab under Discover.
Select Get Started or Create.
Enter https://gitlab.com or the base URL of a self-managed instance.
Paste the token and select Test.
Select one or more groups.
Select Save.

Projects in those groups appear under Pipelines. Use separate integrations for separate instances or credential boundaries.

For a private self-managed address or internal CA, configure Team Server outbound HTTP policy.

Schedule Discovery

Add these jobs to scheduler.jobs:

discover_gitlab_pipelines:
  run: "discover_gitlab_pipelines"
  schedule: "0 4 * * * * *"
discover_gitlab_builds:
  run: "discover_gitlab_builds"
  schedule: "0 6,21,36,51 * * * * *"

Keep calculate_statistics and update_status enabled. Restart Team Server after changing configuration; see Scheduler.

Choose the Runner Pattern

Self-managed Runners

Install the Sensor on every host behind the runner tags used by protected jobs. Bake it into images or provisioning for autoscaled runners.

Use top-level defaults to instrument every job:

default:
  tags:
    - endura
  before_script:
    - endura job start
  after_script:
    - endura job stop

build:
  script:
    - make build

after_script runs during cleanup after the job script. A job that defines its own before_script or after_script replaces the default, so merge the Endura commands back into those jobs.

GitLab-managed Runners

Create masked and protected ENDURA_LICENSE_KEY and ENDURA_SENSOR_TOKEN variables under Settings > CI/CD > Variables. Then install the Sensor inside each ephemeral job:

variables:
  ENDURA_TEAM_SERVER: "https://team-server.example.com"
  ENDURA_BATCHER_AUTOFLUSH: "true"

default:
  before_script:
    - curl -sSf https://repo.endurasecurity.com/install/endura-sensor/testing.sh | sudo -E sh
    - sudo -E endura sensor start -d
    - endura job start
  after_script:
    - endura job stop --exit-zero
    - sudo -E endura sensor stop --exit-zero

build:
  script:
    - make build

The runner must allow the privileges required to load eBPF programs. ENDURA_BATCHER_AUTOFLUSH=true submits telemetry before the runner is destroyed.

Docker Executor

When a self-managed runner uses the Docker executor, mount the host Sensor socket in config.toml:

[[runners]]
  [runners.docker]
    volumes = ["/run/endura/sensor.sock:/run/endura/sensor.sock"]

Restart the runner after editing its configuration. Install the CLI before job start:

default:
  before_script:
    - curl -sSf https://repo.endurasecurity.com/install/endura-sensor/testing.sh | sh
    - endura job start
  after_script:
    - endura job stop

Without the socket mount, the CLI cannot reach the host Sensor.

Child and Multi-stage Pipelines

The top-level default instruments every job in the current configuration.
A child pipeline with a separate configuration must include the same Endura defaults.
Each job is a separate Team Server build, but all jobs in the project share one policy.
Run the complete parent and child flow while deriving the policy.

Standardize Instrumentation

Store the Endura defaults in a central project and adopt them with include:

include:
  - project: platform/ci-templates
    ref: <commit-sha>
    file: /endura.yml

build:
  script:
    - make build

Use extends when jobs need to merge custom setup with the shared wrapper. Pin the include to an immutable revision where possible.

GitLab compliance pipelines are deprecated. Pipeline execution policies inject separate policy jobs and do not automatically bracket arbitrary project jobs, so this guide does not claim either mechanism provides universal Endura instrumentation.

Verify

Run the complete instrumented pipeline.
Open the project under Pipelines in Team Server.
Confirm each protected GitLab job appears under Builds.
If a job is missing, check project discovery, runner tags, Sensor status, overridden defaults, and job logs.

Create and Assign a Policy

Run representative jobs without an assigned policy to derive behavior.
Copy the policy printed by endura job stop.
Create a Team Server policy in observe mode.
Assign it to the project pipeline.
Refine violations across all job types, then change it to enforce.

See Security Policies for the full lifecycle. Configure Slack after violations are reaching Team Server.

GitHub Jenkins