Configuration

The Runtime Sensor is configured entirely through ENDURA_* environment variables. This page is the canonical reference for every supported variable, its default, and its behavior.

How these variables are supplied to the sensor depends on your deployment method:

Bare-metal / native packages: set them in the environment file at /opt/endura/sensor/environ, which the systemd service reads at startup. See your platform’s deployment guide.
Kubernetes (Helm): supply non-sensitive values through sensor.env.* Helm values and sensitive values through the endura-sensor-secrets Secret. See the Kubernetes deployment guide.

Required for Team Server Integration

These variables are required when reporting data to a centralized Team Server instance.

Variable	Description
`ENDURA_LICENSE_KEY`	The license key provided by Endura Security.
`ENDURA_TEAM_SERVER`	The fully qualified URL of your Team Server instance.
`ENDURA_SENSOR_TOKEN`	The sensor token generated by Team Server for this sensor.

Optional Configuration

Variable	Default	Description
`ENDURA_BATCHER_AUTOFLUSH`	`false`	Set to `true` to automatically submit violations as they are detected instead of batching them.
`ENDURA_EXIT_ZERO`	`false`	Set to `true` to make every `endura` command exit with status code `0` even when an error is reported. Useful in CI/CD pipelines where a failing sensor command should not fail the build.
`ENDURA_HTTP_TIMEOUT`	`5`	Number of seconds the HTTP client will wait when interacting with Team Server.
`ENDURA_JOB_TIMEOUT`	disabled	Maximum duration a job may run before it is automatically purged, specified with a suffix: `s` (seconds), `m` (minutes), `h` (hours), or `d` (days). For example, `2h` for two hours. Set to `0` or leave unset to disable.
`ENDURA_LOG_FILE`	`/var/log/endura/sensor.log`	Fully qualified path to a log file on disk for saving logs.
`ENDURA_LOG_LEVEL`	`info`	Log level of either `trace`, `debug`, `info`, `warn`, or `error`.
`ENDURA_SENSOR_KILL_TASK`	`true`	Set to `false` to disable killing tasks/processes that trigger violations.
`ENDURA_SENSOR_POLICY_NOCACHE`	`false`	Set to `true` to re-evaluate policy on every event instead of reusing the cached outcome for repeated events. The default (`false`) reuses cached outcomes to conserve CPU; enabling it raises CPU usage and is intended for diagnostics.
`ENDURA_TLS_VERIFY`	`true`	Controls TLS certificate verification when communicating with Team Server. Setting to `false` is dangerous and only suitable for testing.