Learn about security solutions and standards
Care about security? We do too. Learn what Atlassian does and what you can do too.
Send alerts to Jira
Beacon will soon be part of Atlassian Guard. Read the blog
Use webhooks and Jira Automation to create Jira issues from alerts. About Jira Automation
Who can do this? |
Step 1: Create an automation rule and get the webhook URL
To create an automation rule in Jira:
In Jira, navigate to the project you want to create issues in.
Go to Project settings > Automation.
Select Create rule.
Search for the Incoming webhook component.
Select No issues from the webhook when asked how to execute the automation rule.
Copy the Webhook URL. You’ll need this in the next step.
Save your changes to the Incoming webhook component.
Step 2: Add the webhook URL to Beacon beta (soon to be Guard Detect)
To add the webhook URL:
In Beacon, go to Integrations > SIEM forwarding.
Select Add webhook.
Paste the Webhook URL you copied from Jira and Save.
Step 3: Configure the automation rule to create an issue
In Jira, go back to your automation rule and select THEN: Add an action.
Search for the Create issue component.
Enter details such as project, Issue type, and summary.
Save your changes to the Create issue component.
Name your automation rule and select Turn it on.
You can include data from the webhook payload in a Jira field using the format {{webhookData.<attribute>}}.
For example, you could include the alert title or URL in the issue description to provide quick access to the alert details.
Include the alert title | {{webhookData.alertTitle}} |
Include the alert URL | {{webhookData.alertDetailURL}} |
Step 4: Send a test alert
To send a test alert:
In Beacon, go to Integrations > SIEM forwarding.
Select Send test alert.
If the integration is working you should see a new issue in your Jira project.
When an alert is generated, it will now create a new issue in your Jira project.
What data is sent to your tool?
It’s important to know that once you set up an integration you will be sending alert data to the third party tool of your choosing. We send the alert title, description, and context which can include:
The name of the actor and their profile picture
The name of the subject, which can be a person or an entity (such as a space, project, or policy)
The site URL or page URL where the activity happened.
We respect the visibility settings in the actor’s Atlassian Account profile. If the actor has chosen not to share their profile picture with their Atlassian organization, we respect that setting.
You should make sure that it’s appropriate for this data to be shared with your third party tool before setting up the integration.
Was this helpful?