Jenkins

Connect Jenkins to Team Server, install the Sensor on every build agent, and wrap each protected pipeline with Endura start and stop commands.

Object Mapping

Each Jenkins job has its own Team Server pipeline and policy. Team Server must discover the job before Sensor-reported builds can attach to it.

Prerequisites

• Operator or Administrator access to Team Server
• Jenkins access that can create an API token and edit jobs
• Root access to the controller when it runs builds and to every protected agent host

Configure the Integration

Create an API Token

Use a dedicated Jenkins service account with read access to the jobs Team Server should discover. Under the account’s Configure page, create an API token, set a rotation owner, and store the value with its username in a secrets manager.

Add Jenkins to Team Server

1. Open Integrations, then Jenkins under Discover.
2. Select Get Started or Create.
3. Enter the Jenkins base URL, service-account username, and API token.
4. Select Test, then Save.

Jobs appear under Pipelines. Use separate integrations for separate controllers or credentials. For a private address or internal CA, configure Team Server outbound HTTP policy.

Schedule Discovery

Add these jobs to scheduler.jobs:

discover_jenkins_pipelines:
  run: "discover_jenkins_pipelines"
  schedule: "0 6 * * * * *"
discover_jenkins_builds:
  run: "discover_jenkins_builds"
  schedule: "0 9,24,39,54 * * * * *"

Keep calculate_statistics and update_status enabled. Restart Team Server after changing configuration; see Scheduler.

Install the Sensor on Agents

Install the Sensor on every agent that can execute a protected job and on the controller if it runs builds. Target Sensor-enabled agents with a Jenkins label and include installation in cloud-agent images or provisioning.

See Runtime Sensor deployment.

Instrument a Declarative Pipeline

Use a first stage for job start and post { always { ... } } for cleanup:

pipeline {
    agent { label 'endura' }

    environment {
        BUILD_BRANCH = "${env.BRANCH_NAME}"
    }

    stages {
        stage('Start Endura Job') {
            steps {
                sh 'endura job start'
            }
        }

        stage('Build') {
            steps {
                sh 'make build'
            }
        }
    }

    post {
        always {
            sh 'endura job stop'
        }
    }
}

For a non-multibranch job, map BUILD_BRANCH from env.GIT_BRANCH. Team Server obtains the triggering user and reason from Jenkins build causes, so no separate trigger variables are required.

Prefer declarative pipelines over freestyle jobs because post { always { ... } } guarantees stop handling after failure or abort.

Shared Library

Centralize the lifecycle in a Jenkins Shared Library. Create vars/enduraJob.groovy:

def call(Closure body) {
    try {
        sh 'endura job start'
        body()
    } finally {
        sh 'endura job stop'
    }
}

Then use it from pipelines:

stage('Build') {
    steps {
        enduraJob {
            sh 'make build'
        }
    }
}

Configure the library under Manage Jenkins > System > Global Pipeline Libraries. An implicitly loaded library makes the wrapper available without an @Library annotation.

Docker Agents

The Sensor stays on the Jenkins agent host. Mount its socket and install the CLI in the build container:

pipeline {
    agent {
        docker {
            image 'node:22'
            args '-v /run/endura/sensor.sock:/run/endura/sensor.sock'
        }
    }

    stages {
        stage('Start Endura Job') {
            steps {
                sh 'curl -sSf https://repo.endurasecurity.com/install/endura-sensor/testing.sh | sh'
                sh 'endura job start'
            }
        }

        stage('Test') {
            steps {
                sh 'npm test'
            }
        }
    }

    post {
        always {
            sh 'endura job stop'
        }
    }
}

Without the socket mount, the CLI cannot reach the host Sensor.

Multibranch and Downstream Jobs

• Instrument every Jenkins job that performs protected work, including downstream jobs.
• Each Jenkins job is a separate Team Server pipeline and can have its own policy.
• Branches of a multibranch parent share the discovered parent policy, so derive across representative branches.
• A shared library is the preferred way to keep lifecycle handling consistent.

Verify

1. Run the complete pipeline.
2. Open the Jenkins job under Pipelines in Team Server.
3. Confirm the run appears under Builds.
4. If it is missing, check job discovery, the selected agent label, Sensor status, and start-stage logs.

Create and Assign a Policy

1. Run representative builds without an assigned policy to derive behavior.
2. Copy the policy printed by endura job stop.
3. Create a Team Server policy in observe mode.
4. Assign it to the Jenkins job pipeline.
5. Refine across representative branches and build paths, then change it to enforce.

See Security Policies for the complete lifecycle. Configure Slack after violations are reaching Team Server.