Skip to main content
Endor Labs creates work items in Azure Boards for the findings that violate an action policy or that have a remediation available, and keeps them up to date as those findings change. See Set up Azure Boards integration to configure the integration and the policy that sends notifications to it.

​
Work item lifecycle

After a scan produces matching findings, Endor Labs creates a parent work item in the mapped Azure DevOps project, using the work item type you configured. When you configure a child work item type, findings tied to a dependency create a child work item under the parent. During later scans, Endor Labs adds a comment to the work item when findings change. When the findings resolve, Endor Labs transitions the work item to its completed state and adds a resolution comment.

​
View work items in Azure DevOps

Track the work items Endor Labs created from the mapped project in Azure DevOps.
  1. Sign in to your Azure DevOps organization.
  2. Select Boards > Work items for the mapped project.
  3. Select the work item to view its details, including tags and comments added by Endor Labs.

​
View Azure Boards notifications in Endor Labs

Track the notifications that created your Azure Boards work items, including the policy that triggered each one and the number of violations.
  1. Select User menu > Notifications from the left sidebar.
  2. Select Open, Resolved, Dismissed, or All to view the notifications listed under them.
  3. From Channels, select ADO Boards to show only the notifications delivered to Azure Boards.
  4. From Table Preferences, turn on Ticket ID to show the work item ID for each notification. This column is hidden by default, because only Jira and Azure Boards targets report a ticket ID.
  5. Search by policy name or ticket ID to find a notification.
  6. Select a notification, then select Overview to see the work item Endor Labs opened and its parent.
  7. Click the vertical three dots on the notification, then select one of the following:
    • Dismiss Notification: Stop all further processing and updates for the notification. The notification moves to Dismissed.
    • Go to Policy: View configuration details of the policy that created this work item.
Azure Boards work item IDs appear as plain text. Endor Labs can’t link to the work item in Azure DevOps, because Azure DevOps doesn’t return a deep link with the work item. A notification that failed to reach Azure Boards is flagged with an error. Select the notification, then select Issues to see the delivery error.

​
FAQs

The work items remain in Azure DevOps. Deleting an integration stops Endor Labs from creating and updating work items through it, and it doesn’t change the work items it already created.
No. Organization URL and the credential source are locked after you create an integration. Add a new integration for a different organization.
Check that an action policy or remediation policy references the Azure Boards notification target, that the repository maps to a configured Azure DevOps project, and that the personal access token has the Work Items: Read & write scope. Select the notification, then select Issues to see any delivery error.
Endor Labs creates a shared parent work item only for dependency aggregations. With Dependency or Dependency per Package Version, each finding in the aggregation becomes a child work item under one parent, and findings in the same aggregation reuse that parent. Endor Labs completes the parent when the last child resolves, and a dismissed child keeps the parent open.With any other aggregation type, such as None (Notify for each Finding) or Project, Endor Labs creates a single work item with no parent and doesn’t use the child work item type.
Yes. Choose a parent work item type that includes a Description field. The default Epic, Issue, and Task types include this field, but a custom work item type might not.