Code & CI/CD Integrations

Software supply chain attacks are among the fastest-growing threat vectors. Compromised CI/CD pipelines, stolen GitHub tokens, malicious code commits, and secret exposure in repositories can give attackers persistent access to production environments. Code and CI/CD monitoring bridges the gap between development and security operations.

ManySignal ingests GitHub organisation audit log events: user additions/removals, repository access changes, branch protection changes, personal access token creation, OAuth application grants, Actions workflow runs, and secret scanning alerts.

Yes. GitHub Secret Scanning alerts are ingested by ManySignal and correlated with subsequent anomalous API usage using matching credential formats — linking the exposure event to potential exploitation.

Yes. GitHub Actions workflow run events, including the specific action versions used, are ingested. ManySignal detects sudden action version changes, use of unverified third-party actions, and workflow runs that make unexpected outbound connections.

ManySignal ingests Terraform Cloud workspace run events (plan, apply, destroy) and correlates them with the downstream cloud provider API calls generated by those runs. This enables detection of out-of-band infrastructure changes that bypass the Terraform workflow.

Yes. ArgoCD deployment events, sync status changes, and access control modifications are ingested. ManySignal detects unexpected deployment sources, manual sync overrides, and unauthorised ArgoCD admin access.

Yes. ManySignal detects anomalous GitHub personal access token usage: access from a new country, unexpected API calls (accessing private repos not normally accessed), or token usage from an IP outside the developer's known range.

ManySignal ingests GitHub Copilot usage telemetry. Anomalous patterns — Copilot suggestions including sensitive internal data, bulk code submission that may represent data exfiltration — are flagged based on the ManySignal AI attack surface coverage.

Jenkins is self-hosted, so ManySignal uses a log agent deployed on the Jenkins controller host to forward audit trail and system logs. No inbound network access to Jenkins is required.

Yes. Pipeline steps that access secrets and then make outbound connections to unexpected endpoints are detected as suspicious. ManySignal correlates the pipeline actor identity, the secrets accessed, and the network connections made during the build.