This is the multi-page printable view of this section. Click here to print.

Return to the regular view of this page.

Deploy Endor Labs Bitbucket App in Bitbucket Data Center

Learn how to continuously monitor your environment with the Endor Labs Bitbucket App.

This is the multi-page printable view of this section. Click here to print.

Return to the regular view of this page.

Learn how to continuously monitor your environment with the Endor Labs Bitbucket App.
Beta

Endor Labs provides a Bitbucket App that continuously monitors users’ projects for security and operational risks in Bitbucket Data Center. You can use the Bitbucket App to selectively scan your repositories for SCA, secrets, SAST, and CI/CD tools.

When you use the Endor Labs Bitbucket App, it creates namespaces based on your projects in Bitbucket Data Center. The namespaces created by the Endor Labs Bitbucket App are not like regular namespaces and are called managed namespaces. You can either configure the URL to Bitbucket Data Center to import all the projects or configure the project key to import a specific project in Endor Labs.

See Manage Bitbucket Data Center App to learn how to manage your Bitbucket Data Center App integration in Endor Labs.

You need to add the Bitbucket Data Center host or a project to an Endor Labs namespace. Bitbucket host and projects are mapped as managed namespaces in Endor Labs.

Managed namespaces have the following restrictions:

  • You cannot delete managed namespaces.
  • You cannot delete repositories within managed namespaces.
  • You cannot add projects or create namespaces within managed namespaces.
  • You cannot create new Endor Labs App installations within managed namespaces.

When you add a Bitbucket Data Center host to an Endor Labs namespace, Endor Labs creates a child namespace for the Bitbucket host and creates child namespaces for each project in the host under the host namespace. The namespaces of the host and projects are managed namespaces. If there are periods (.) in the Bitbucket datacenter hostname, it is converted to a hyphen (-). You can add multiple Bitbucket Data Center hosts to the same Endor Labs namespace. Each host will have its own managed namespace.

If your host name is bitbucket.deerinc.com and you have three projects, buck, doe, and fawn, Endor Labs creates four managed namespaces: bitbucket-deerinc-com, buck, doe, and fawn. The namespaces buck, doe, and fawn are child namespaces of the bitbucket-deerinc-com namespace.

The following image shows the namespace structure in Endor Labs.

graph TD

      %% Endor Labs namespace
      EN[endor-bitbucket]

      %% Bitbucket projects
      O1[bitbucket-deerinc-com]
      P1[buck]
      P2[doe]
      P3[fawn]


      %% connections
      EN --> O1
      O1 --> P1
      O1 --> P2
      O1 --> P3

      class EN,EN2 endor
      class O1,P1,P2,P3 managed
      classDef managed fill:#3FE1F3

When you add a Bitbucket Data Center project to an Endor Labs namespace, Endor Labs creates a child namespace for the Bitbucket Data Center project and maps all repositories in that project to this namespace. The child namespace that maps to the Bitbucket Data Center project is a managed namespace. The managed namespace has the name, <host name>_<project name>. For example, if your Bitbucket hostname is bitbucket.deerinc.com and project name is doe, the managed namespace will have the name, bitbucket-deerinc-com_doe.

You can add multiple projects to the same Endor Labs namespace. Each project will have its own managed namespace. For example, your hostname is bitbucket.deerinc.com, which has three projects, buck,doe, andfawn. You add each project to the Endor Labs namespace, endor-azure.

The following image shows the namespace structure in Endor Labs.

graph TD

      %% Endor Labs namespace
      EN[endor-bitbucket]

      %% Bitbucket projects
      A1[bitbucket-deerinc-com_buck]
      A2[bitbucket-deerinc-com_doe]
      A3[bitbucket-deerinc-com_fawn]


      %% connections
      EN --> A1
      EN --> A2
      EN --> A3

      class EN,EN2 endor
      class A1,A2,A3 managed
      classDef managed fill:#3FE1F3

Ensure the following prerequisites are in place before you install the Endor Labs Bitbucket App.

  • A publicly accessible Bitbucket Data Center host set up with HTTPS.
  • A Bitbucket HTTP access token with at least Project read permission at the project level.
  1. Sign in to Endor Labs.

  2. Select Projects from the left sidebar and click Add Project.

  3. From BITBUCKET, select Bitbucket App, and select Data Center to import projects from Bitbucket Data Center.

    Bitbucket App

  4. Enter the Bitbucket hostname URL in the format: https://<host name> to import all the projects.

    Endor Labs creates namespaces for all projects that are available in the Bitbucket Data Center host.

    You can also provide the URL up to a project level to import a specific project: https://<host name>/projects/<project-key>. For example, https://endor-bitbucket.com/projects/LAB.

  5. Enter the Bitbucket Data Center HTTP access token.

    The HTTP access token must have at least the Project read permission at the project level.

  6. Select the scan types to enable.

    • SCA: Perform software composition analysis and discover AI models used in your repository.
    • Secret: Scan Bitbucket projects for exposed secrets.
    • CI/CD: Scan Bitbucket projects and identify all the CI/CD tools used.
    • SAST: Scan Bitbucket projects to generate SAST findings.

    The available scan types depend upon your license.

  7. Select Include Archived Repositories to scan your archived repositories.

    By default, the Bitbucket archived repositories aren’t scanned.

  8. Click Create.

Endor Labs Bitbucket App scans your Bitbucket projects every 24 hours and reports any new findings or changes to release versions of your code.

Manage Bitbucket Data Center App on Endor Labs

You can make changes to the Bitbucket Data Center App integrations or delete them. You can view the activity logs for the Bitbucket App and rescan your Bitbucket projects on demand.

  1. Sign in to Endor Labs and select Manage > Integrations from the left sidebar.

  2. Click Manage next to Bitbucket under Source Control Managers.

    Manage Bitbucket App

  3. Click the three vertical dots next to the integration.

    You can choose from the following options:

To edit the Bitbucket App integration:

  1. Click the three vertical dots next to the integration, and select Edit Integration.

  2. You can update your personal access token and choose the scanners. Edit Bitbucket App

  3. Click Save.

    The changes are applicable from the next scanning cycle.

To delete a Bitbucket App integration, click the three vertical dots next to the integration, and select Delete Integration.

Manage Bitbucket App

When you delete the integration, it will also delete all child namespaces, projects and references associated with the auto-generated root group namespace. It also deletes any manually created namespaces and projects under auto-generated namespace.

Endor Labs detects and reports installation and synchronization errors during organization sync. These include expired tokens, insufficient permissions, invalid host configurations, and certificate issues. Sync logs report those errors that you can resolve.

Sync logs showing error

To view sync logs, click the three vertical dots next to the integration, and select View Sync Logs.

The sync logs display details of synchronization attempts, including timestamps, error types, and diagnostic messages. These logs help identify issues such as authentication failures or configuration problems.

The sync logs detect and display the following categories of sync failures:

  • Expired or invalid Personal Access Tokens (PATs): The PAT used for authentication has expired or is no longer valid. Edit the integration and provide a valid token.
  • Insufficient PAT permissions: The PAT does not have the required scopes, such as repository read access. You must generate and provide a PAT with the correct access.
  • Certificate related access issues: The certificates required to connect to the SCM are invalid, outdated, or untrusted. This error occurs in self-hosted GitLab instances that use custom SSL certificates. Update the certificate configuration or ensure the certificate chain is properly trusted to resolve the issue.
  • Incorrect or invalid host URLs: The configured URL is incorrect or unreachable. Since you cannot edit the host URL, you need to delete and reinstall the integration using the correct URL.

After you resolve the issue, the error is automatically cleared during the next successful scan. You can manually re-trigger the scan using Rescan Org to verify the resolution immediately.

Bitbucket App scans your repositories every 24 hours. Click Rescan Org to manually trigger a scan outside the 24-hour period.

Click Scan More Repositories to go to Projects, where you can add more projects to scan through the Bitbucket App.