Integrate GitHub Advanced Security with Jira
These instructions are for connecting GitHub Cloud or GitHub Enterprise Cloud to Jira. Show me how to connect GitHub Enterprise Server
The security feature in Jira allows you to view, triage, and track security vulnerabilities from GitHub Advanced Security. To get this feature working, you’ll need to:
Install the GitHub for Jira app.
Connect a GitHub organization.
Add GitHub Advanced Security to your Jira project.
Connect security containers to your project.
Before you begin
To install and set up the GitHub for Jira app, you need:
Site administrator permission for your Jira site.
Organization owner permission for your GitHub organization.
For some organizations, the task of integrating GitHub Advanced Security might involve multiple team members:
A Jira site admin will install the GitHub for Jira app.
A GitHub organization owner will connect a GitHub organization to your Jira site.
A Jira project admin will add GitHub Advanced Security to a project and connect security containers.
Install the GitHub for Jira app
In Jira, select Apps, then select Explore more apps.
Search for GitHub for Jira, then select it from the results.
Select Get app, then Get it now.
Connect a GitHub organization
After the app is installed, select Get started. If the app is already installed on your Jira site, you can find this section by selecting Apps, then Manage your apps, and then GitHub for Jira.
Select Continue.
Select GitHub Cloud, then Next.
Enter your GitHub username and password, then Sign in.
Find the organization you want to connect to Jira, then select Connect.
To check your permissions for a GitHub organization, open your GitHub organization settings and look for your permission level next to the organization name. Organization owners can review and accept permission requests from Jira in your organization settings. More about required permissions for GitHub for Jira
Add GitHub Advanced Security to your Jira project
To track security vulnerabilities from GitHub in your Jira project, you’ll need to add GitHub Advanced Security to your project. If you want to track vulnerabilities in more than one Jira project, add GitHub Advanced Security to each one.
Next to your project's name in the sidebar, select More actions (•••), then Project settings.
Select Toolchain.
Select the Add button, then Add tool.
Find GitHub Advanced Security, then select Add to project.
Connect security containers to your project
Before you can view vulnerabilities in the security feature, you must add at least one security container to your project.
Next to your project's name in the sidebar, select More actions (•••), then Project settings.
select Work items > Security.
Select Edit security containers.
Select the add connection button (+) for GitHub Advanced Security.
Choose a container from the list, then select Add.
The security feature will now show the most recent vulnerabilities from your connected security containers in GitHub. Here’s how to link security vulnerabilities to Jira issues so you can triage and track them with your team.
Fix out-of-sync GitHub vulnerabilities in Jira
Occasionally, security vulnerabilities may be withdrawn in GitHub Advanced Security without being updated in Jira. If you notice a number of these withdrawn vulnerabilities still appearing in Jira, you can disconnect and reconnect the affected organization to make sure you’re seeing the latest data.
To disconnect the organization:
In Jira, select Apps, then Manage your apps.
Select GitHub for Jira, then Get started.
Find the organization you’re having trouble with, select the more actions icon (…), then select Disconnect.
Select Disconnect again to confirm.
Then, to reconnect the organization:
Select Connect a GitHub organization, then Connect GitHub Cloud.
Select Continue.
Select GitHub Cloud, then Next.
Enter your GitHub username and password, then Sign in.
Find the organization you want to connect to Jira, then select Connect.
When connection is complete, select Exit set up.
The organization has now been reconnected to Jira. Wait for the backfill process to complete, and all your GitHub security data will be up to date in Jira.
Was this helpful?