AppCheck supports integration with Jira Cloud instances using version 2 of their REST API.

Integration with on-premises Jira instances may be possible but it is not officially supported.

• Prerequisites
• Accessing Integration Settings
• Configuration
• Advanced Information

Prerequisites

• You must have purchased Jira integration with AppCheck.
• You must be an admin user in AppCheck to access organisation settings.
• You must have permission to create and edit issues in the chosen board in Jira.
• You must have permission to perform workflow transitions if required.
• Jira integration must be configured at the organisation level before it can be configured for individual scans.

Accessing Integration Settings

After purchasing our Jira integration you will see Jira listed as an option in the Integrations area of the AppCheck portal:

You will need to be an administrator in AppCheck to access the Integrations screen.  If the Jira option is still missing for you please raise a ticket with AppCheck Support.

You must create one or more Jira integration profiles before you are able to configure it for individual scans.

Configuration

1. Configure one or more Jira integration profiles in AppCheck
2. Configure Jira
3. Test
4. Configure one or more AppCheck scans to use your Jira profile

Configure one or more Jira integration profiles in AppCheck

In the Integrations screen in AppCheck, click Jira and create a new profile.

Configure the following information in your profile:

Basic Settings

Vulnerabilities to send

In this section you can specify the Vulnerabilities to send to Jira based on their impact; eg if you select High and Critical then vulnerabilities with a High or Critical impact will be sent.

Advanced Settings

Configure Jira

Configure your Jira instance with the following information:

Webhooks

You will requires Jira admin privileges to configure webhooks.

• Webhooks must fire only for issues managed by AppCheck.
• Configure webhooks in Jira System Settings.

Issue Webhook

URL: https://scanner.appcheck-ng.com/integration/jira/<webhook-token>/vuln/update/{issue.id}

Comment Webhook

URL: https://scanner.appcheck-ng.com/integration/jira/<webhook-token>/vuln/note/{comment.id}

Create events are ignored as AppCheck creates the issues. Delete events are ignored as AppCheck does not handle deletions.

Workflow Constraints

• At least 2 transitions should exist (ideally 4 for each AppCheck status, unfixed/fixed/false positive/acceptable risk).
• Issues should be able to move between any statuses (needed for redetection handling).

Jira Board Requirements

• Issues must have the following fields: summary, description, labels, priority.
• Issue tracking must be enabled.
• At least 1 priority (ideally 3: low, medium, high).

Test

Once your AppCheck Jira profile is configured, and your Jira instance is configured, click Test in your AppCheck Jira profile to confirm everything is working.

Configure one or more AppCheck scans to use your Jira profile

In the integrations section of your scan configurations you can now select one of more Jira integration profiles to be used for that scan.

No vulnerabilities will be sent to Jira by a scan which does not have a profile selected.

Multiple profiles can be attached to a single scan; however, a vulnerability will only be linked to a single profile. For example, attaching two profiles with only High and only Medium enabled would cause no conflicts; attaching two profiles both with High enabled will mean the vulnerability only gets linked to the first profile in the list.

This behaviour is also the same across scans - if the same vulnerability appears in two different scans, with two conflicting profiles, whichever profile the vulnerability was linked to first will be used for future updates (regardless of the scan causing the update)

Advanced Information

Customising Jira IDs

Finding Jira IDs

Finding Priority IDs

1. Navigate to: https://[Your Jira instance root URL]/rest/api/2/priority
2. For each priority (High, Medium, Low), locate the desired Jira priority and record its "id" field.

Finding Status IDs

1. Find the issue ID for an issue in the correct project. If needed, use the "Export XML" option in Jira to find the key.
2. Navigate to: https://[Your Jira instance root URL]/rest/api/2/issue/[issue-ID]/transitions
3. Find the status name and corresponding "id" for each AppCheck status: Fixed, Acceptable Risk, False Positive, Unfixed.
4. Add these IDs to the AppCheck integration settings.

General Notes