TeamCity

Connect TeamCity to Team Server, install the Sensor on every build agent, and add first and final Endura steps to protected build configurations.

Object Mapping

One TeamCity project is one Team Server pipeline. All build configurations in the project share one policy. Subprojects are discovered separately. Team Server must discover the project before Sensor-reported builds can attach to it.

Prerequisites

• Operator or Administrator access to Team Server
• TeamCity access that can create a token and edit build configurations
• Root access to every protected Build Agent host

Configure the Integration

Create a Token

Use a dedicated TeamCity service account with read access to the required projects. Under Profile > Access Tokens, create a token scoped to those projects, set an expiration and rotation owner, and store it in a secrets manager.

Add TeamCity to Team Server

1. Open Integrations, then TeamCity under Discover.
2. Select Get Started or Create.
3. Enter the TeamCity base URL and token.
4. Select Test, then Save.

Projects appear under Pipelines. Use separate integrations for separate servers or credentials. For a private address or internal CA, configure Team Server outbound HTTP policy.

Schedule Discovery

Add these jobs to scheduler.jobs:

discover_teamcity_pipelines:
  run: "discover_teamcity_pipelines"
  schedule: "0 8 * * * * *"
discover_teamcity_builds:
  run: "discover_teamcity_builds"
  schedule: "0 12,27,42,57 * * * * *"

Keep calculate_statistics and update_status enabled. Restart Team Server after changing configuration; see Scheduler.

Install the Sensor on Agents

Install the Sensor on every Build Agent in pools that can run protected configurations. Include installation in images or provisioning for autoscaled agents. See Runtime Sensor deployment.

Configure Build Parameters

Add these environment parameters at the Root Project, project, or build-configuration level:

Root Project parameters are inherited by subprojects and configurations unless overridden.

Instrument a Build Configuration

First Step

Under Build Steps, add a Command Line step named Start Endura Job with this custom script:

endura job start

Move it before all build work.

Final Step

Add a Command Line step named Stop Endura Job:

endura job stop

Move it last and set Execute step to Always, even if build stop command was issued. This setting is required for cleanup after failures and cancellation.

Build Configuration Templates

Create a TeamCity template containing the three parameters and both Endura steps. In the step-order editor:

1. place Start Endura Job above the build-configuration steps placeholder;
2. place Stop Endura Job below it; and
3. attach the template to every existing protected configuration.

Set it as the project’s default template for new configurations. Existing configurations must still be attached explicitly.

Container Builds

When a TeamCity build runs in a Docker or Container Wrapper, the Sensor remains on the Build Agent host. Mount:

/run/endura/sensor.sock:/run/endura/sensor.sock

Install the CLI in the first step:

curl -sSf https://repo.endurasecurity.com/install/endura-sensor/testing.sh | sh
endura job start

Keep the final stop step configured to always run. Without the socket mount, the CLI cannot reach the host Sensor.

Build Chains and Composite Builds

• Instrument each build configuration in a snapshot-dependency chain.
• Configurations in one project share its policy; configurations in separate projects can use separate policies.
• Put Endura steps on underlying configurations, not composite configurations that execute no build work.
• Run the full chain while deriving the project policy.

Verify

1. Run each instrumented build configuration.
2. Open the TeamCity project under Pipelines in Team Server.
3. Confirm each run appears under Builds.
4. If a build is missing, check discovery, agent pool placement, Sensor status, template attachment, and step logs.

Create and Assign a Policy

1. Run representative configurations without an assigned policy to derive behavior.
2. Copy the policy printed by the final endura job stop step.
3. Create a Team Server policy in observe mode.
4. Assign it to the TeamCity project pipeline.
5. Refine across all configuration types, then change it to enforce.

See Security Policies for the complete lifecycle. Configure Slack after violations are reaching Team Server.