Getting started

​

Log in to Endor Labs

1. Visit https://app.endorlabs.com to access the login page.
2. You can sign in to Endor Labs with the following options:
   • Google Workspace
   • GitHub
   • GitLab
   • Email Link
   • Supported enterprise SSO providers
3. Select Get Started on the left sidebar to explore the available options.
   • Select Start Tour to take a guided tour of the application and understand its main features.
   • Select Explore Demo Sandbox to view Endor Labs capabilities and explore its features in a read-only tenant.
   • Select SCAN WITH GitHub App to install the Endor Labs GitHub App.
   • Select SCAN VIA GitHub Actions to scan a demo repository from GitHub and view findings.
   • Select SCAN VIA CLI to set up your tenant and start scanning your repositories with the CLI.
   
4. See the quick start to set up with your first project scan.

​

Quick start

• endorctl
• GitHub App

​

Quick start with GitHub App

​

Prerequisites for GitHub App

• A GitHub cloud account and organization. If you don’t have one, create one at GitHub.
• Administrative permissions to your GitHub organization. Installing the Endor Labs GitHub App in your organization requires approval or permissions from your GitHub organizational administrator.
• Endor Labs GitHub App requires read permissions to Dependabot alerts, actions, administration, checks, code, commit statuses, issues, metadata, packages, pull requests, repository hooks, and security events. It does not need write access to any resources.

​

Set up the GitHub App with Endor Labs

1. Sign in to Endor Labs and select Get Started from the left sidebar.
2. Select SCAN WITH GitHub App and click Install GitHub App Pro. Deselect Enable Automated Pull Requests to disable automatic PR remediation and to install the GitHub App.
   You can only install either the GitHub App or the GitHub App (Pro) in your environment.
   
3. Choose the user and the organization where you wish to install the app.
4. Select whether to install and authorize Endor Labs on all your repositories or select the specific repositories that you wish to scan.
5. Click Install & Authorize.
   If the button to install says Install and Request instead of Install and Authorize, you don’t have permission to install the app. Select Install and Request to notify your organizational administrator of your request.
   
6. Select the Endor Labs namespace that you want to use and click Next.
7. Select the scan types to enable under SCANNERS. The following scanners are available:
   • SCA: Perform software composition analysis and discover AI models used in your repository.
   • RSPM: Scan the repository for misconfigurations.
   • Secret: Scan the repository for exposed secrets.
   • CI/CD: Scan the repository and identify all the CI/CD tools used in the repository.
   • SAST: Scan your source code for weakness and generate SAST findings.
8. Select Include Archived Repositories to scan your archived repositories. By default, the GitHub archived repositories aren’t scanned.
9. Select the PULL REQUEST SCANS to automatically scan the PRs submitted by users.
   • Select Pull Request Comments to enable GitHub Actions to comment on PRs for policy violations.
   • In Define Scanning Preferences, select either:
     • Quick Scan to gain rapid visibility into your software composition. It performs dependency resolution but does not conduct reachability analysis to prioritize vulnerabilities. The quick scan enables users to swiftly identify potential vulnerabilities in dependencies, ensuring a smoother and more secure merge into the main branch.
     • Full Scan to perform dependency resolution, reachability analysis, and generate call graphs for supported languages and ecosystems. This scan enables users to get complete visibility and identifies all issues dependencies, call graph generation before merging into the main branch. Full scans may take longer to complete, potentially delaying PR merges.
     See GitHub scan options for more information on the scans that you can do with the GitHub App.
10. Click Create.

​

Quick start with endorctl

1. Install Endor Labs on your local system
2. Authenticate to Endor Labs
3. Clone your repository
4. Scan your first project
5. Review your results

​

Install endorctl

​

Install with Homebrew (macOS/Linux)

brew tap endorlabs/tap
brew install endorctl

​

Install with npm (macOS/Linux/Windows)

npm install -g endorctl

​

Download binary directly

curl https://api.endorlabs.com/download/latest/endorctl_linux_amd64 -o endorctl
echo "$(curl -s https://api.endorlabs.com/sha/latest/endorctl_linux_amd64)  endorctl" | sha256sum -c
chmod +x ./endorctl

curl https://api.endorlabs.com/download/latest/endorctl_macos_arm64 -o endorctl
echo "$(curl -s https://api.endorlabs.com/sha/latest/endorctl_macos_arm64)  endorctl" | shasum -a 256 -c
chmod +x ./endorctl

curl -O https://api.endorlabs.com/download/latest/endorctl_windows_amd64.exe
ren endorctl_windows_amd64.exe endorctl.exe

​

Authenticate to Endor Labs

endorctl init --auth-mode=google

endorctl init --auth-mode=github

endorctl init --auth-mode=gitlab

endorctl init --auth-email=<insert_email_address>

endorctl init --auth-mode=sso --auth-tenant=<insert-your-tenant>

​

Clone your repository

git clone https://github.com/username/repo-name.git

cd <repo-name>

​

Run your first scan

• Scan for OSS risk
• Scan for leaked secrets
• Scan for GitHub misconfigurations

​

Scan for OSS risk

1. Install software prerequisites
2. Clone your repository
3. Build your software
4. Scan with Endor Labs for OSS risk

Install software prerequisites

• A local installation of Git or the ability to clone repositories in CI. See the Git documentation for instructions on installing Git
• A runtime environment and build tools for supported software development languages your team uses must be installed on any system used for testing. For more information, see Supported languages and frameworks.

Build your software

mvn dependency:tree
mvn clean install

gradle dependencies --configuration runtimeClasspath
./gradlew assemble
# Use `gradle assemble` if you do not have a gradle wrapper in your repository

npm install

yarn install

export ENDOR_PNPM_ENABLED=true
pnpm install

export ENDOR_RUSH_ENABLED=true
rush install

dotnet restore
dotnet build

composer install

go mod tidy

python3 -m venv venv
source venv/bin/activate
venv/bin/python3 -m pip install

poetry install

bundler install

pod install

sbt projects
sbt compile
sbt dependencyTree

gradle dependencies --configuration runtimeClasspath
./gradlew assemble
# Use `gradle assemble` if you do not have a gradle wrapper in your repository

cargo build

Scan your project for OSS risk

endorctl scan

endorctl scan --languages=<languages-list>

Scanning an example repository

1. Clone the repository https://github.com/OWASP-Benchmark/BenchmarkJava.git
   git clone https://github.com/OWASP-Benchmark/BenchmarkJava.git
   
2. Navigate to the repository on your local system
   cd BenchmarkJava
   
3. Build the repositories package with Maven:
   mvn clean install
   
4. Scan the repository
   endorctl scan
   

Scanning for leaked secrets

endorctl scan --secrets

endorctl scan --secrets --git-logs

Scan for GitHub misconfigurations

​

Prerequisites

• The GitHub repository HTTPS clone URL
• A personal access token with access administrative access to the repository. For help creating a personal access token see GitHub documentation.

• The GitHub API URL (This is typically the FQDN of the GitHub server)
• A local copy of the CA Certificate if the certificate is self-signed or from a private CA

Running a misconfiguration scan

1. Export your personal access token as an environment variable:
   export GITHUB_TOKEN=<personal_access_token>
   
2. Scan the repository to retrieve configuration information and analyze the configuration against organizational policy or configuration best practices:
   endorctl scan --repository-http-clone-url=https://github.com/<organization>/<repository>.git --github
   

endorctl scan --github-api-url=https://<fully_qualified_domain_name_to_GitHub_Enterprise_Server> --repository-http-clone-url=https://<fully_qualified_domain_name_to_GitHub_Enterprise_Server>/<organization>/<repository>.git --github

​

Review the results of your project

• Sign in to the Endor Labs user interface, click Projects on the left sidebar.
• The Findings section provides a summary of vulnerabilities found in each project, categorized by severity:
  • C: Critical
  • H: High
  • M: Medium
  • L: Low
• Under Packages, the number indicates the identified packages. Click on the icon next to the number to open a right sidebar containing the following details :
  • Project metadata: Information such as UUID, repository details, dependencies, and repository versions.
  • Findings: A breakdown of the detected vulnerabilities categorized by dependency, package, repository, secrets, and CI workflows.
  • Tools used during analysis: A list of tools involved in the scanning process.
• Select your project to view its details. See Findings for more information.

​

Next steps

• Explore the Endor Labs user interface to learn how to navigate through the platform.