We are using a "classical" DevOps process and in our CI/CD we do a lot of testing - also GUI-testing with Selenium.
Our CI/CD is on premise and not reachable from the outside. At the moment we also have to deal with supply chain risks through compromised third party libraries mostly from npm. One of the major risks here is data exfiltration from within the running application. For this the compromised library must be able to reach a command and control server.
What I was thinking, since the application is actually running during the testing phase but kind of sandboxed in the CI/CD, it would be great to monitor all connection attempts from the application and compare it with a whitelist of known addresses.
Using a proxy on the hosting machine is probably not a solution, since I cannot get granular information which application tried which connection if there are running several build processes in parallel.
I took a look at Jenkins and GitLab but could not find a native solution or plugin for this. Tools like netstat seem only to show the established connections but not the attempts. I also read about enabling firewalld logging for denied packages but I'm not so deep into networking to figure out if it's possible to reproduce a blocked package to the corresponding build pipeline.
Is there some state of the art approach for this issue? It kind of seems nearby regarding supply chain risks.