Set up and use the Jira connector

The Veracode Risk Manager (VRM) connector for Jira integrates VRM’s best next actions and issues with Jira's issue-tracking tools. It leverages the Jira Cloud REST API to create tickets, ensuring that VRM’s powerful recommendations move to the next stage of remediation and are routed to the correct team workflows.

Complete the following tasks to set up and use your VRM connector for Jira.

Jira requirements

Your Atlassian user account must have:

• Member access to the Jira projects you want to connect to VRM. :::note Even if you're an administrator of your Jira instance, you must be a member of the projects.
• The following Jira permissions:
  • write:issue:jira
  • write:comment:jira
  • write:comment.property:jira
  • write:attachment:jira
  • read:issue:jira :::

Create an API token

You need to create a scoped API token to access Jira APIs.

To complete this task:

1. In Jira, navigate to Settings > Security > Create API token with scopes.

2. Select Next, then select Jira as the application.

3. Select Next again, then select the following scopes:

   • read:jira-work
   • write:jira-work
   • read:jira-user (to fetch user details)

   The following table shows how Veracode uses these scopes:

   API Endpoint	HTTP Method	Required Scopes
   List Projects	GET /rest/api/3/project/search	read:jira-work
   List Issue Types	GET /rest/api/3/issuetype/project	read:jira-work
   Get Create Metadata/Fields	GET /rest/api/3/issue/createmeta/{projectId}/issuetypes/{issueTypeId}	read:jira-work
   Group/User Picker	GET /rest/api/3/groupuserpicker	read:jira-work
   Create Single Issue	POST /rest/api/3/issue	write:jira-work
   Create Bulk Issues	POST /rest/api/3/issue/bulk	write:jira-work

4. Select Create token, then copy the token and save it to a secure location.

For more information, see Atlassian's API token documentation.

Create a VRM connector

1. In VRM, select the Settings icon from the left navigation menu.
2. Select Add Connector.
3. Select the Jira tile.
4. Enter a name for the connector.
5. Enter the email address of the user account you want to associate with the connector.
6. Paste the API token that you generated for the Jira user account.
7. Enter the full URL for your Jira organization. For example: https://myorganization.atlassian.net
8. Select Add Connector.

Creating tickets in VRM

The Jira connector lets you create Jira tickets from the Issues page, directly from an issue summary, and from the Solutions page in VRM.

Create a ticket from the Issues page

1. In VRM, select the Issues icon from the left navigation menu.
2. Select the checkbox for an issue.
3. Select Actions > Create Ticket.
4. For Connection Name, select your Jira connector. VRM generates a Jira ticket with following fields pre-populated:
   • Project: the name of the Jira project in which you want to create the issue.
   • Type: Task, Story, and Bug are the only supported ticket types.
   • Summary: the name of the issue. Not editable.
   • Description: an outline of the affected assets, where the issues were detected, and possible solutions. Not editable.
   • Status: the workflow status of the issue in VRM. By default, creating a ticket moves the status to Noted.
   • Reason: the reason that the status is changing. By default, creating a ticket sets the reason to Remediating Risk.
   • Comment: comments to include in the Jira ticket.
5. If necessary, edit the pre-populated fields.
6. Select Create Ticket. When the ticket is created in Jira, a pop-up window appears in VRM that includes a link to the ticket.

Create a ticket from the Issue Summary page

1. In VRM, select the Issues icon from the left navigation menu.
2. Select an issue.
3. Select Create Ticket in the upper-right corner of the screen. If a ticket already exists for an issue, select Tickets > File Another Ticket in the upper-right corner of the screen.
4. For Connection Name, select your Jira connector. VRM generates a Jira ticket with following fields pre-populated:
   • Project: the name of the Jira project in which you want to create the issue.
   • Type: Task, Story, and Bug are the only supported ticket types.
   • Summary: the name of the issue. Not editable.
   • Description: an outline of the affected assets, where the issues were detected, and possible solutions. Not editable.
   • Status: the workflow status of the issue in VRM. By default, creating a ticket moves the status to Noted.
   • Reason: the reason that the status is changing. By default, creating a ticket sets the reason to Remediating Risk.
   • Comment: comments to include in the Jira ticket.
5. If necessary, edit the pre-populated fields.
6. Select Create Ticket. When the ticket is created in Jira, a pop-up window appears in VRM that includes a link to the ticket.

Create a ticket from the Solutions page in VRM

1. In VRM, select the Solutions icon from the left navigation menu.
2. Expand the remediation for which you want to create a ticket.
3. Select the items from the Summary of Changes table that you want to include in the ticket.
4. Select Actions:[number] Changes > Create Ticket.
5. For Connection Name, select your Jira connector. VRM generates a Jira ticket with following fields pre-populated:
   • Project: the name of the Jira project in which you want to create the issue.
   • Type: Task, Story, and Bug are the only supported ticket types.
   • Summary: the name of the issue. Not editable.
   • Description: an outline of the affected assets, where the issues were detected, and possible solutions. Not editable.
   • Status: the workflow status of the issue in VRM. By default, creating a ticket moves the status to Noted.
   • Reason: the reason that the status is changing. By default, creating a ticket sets the reason to Remediating Risk.
   • Comment: comments to include in the Jira ticket.
   • Ticket and subtasks to be created:: select each subtask for which you want to create a Jira ticket. The ticket for each subtask will be a child of the parent ticket.
6. If necessary, edit the pre-populated fields.
7. Select Create Ticket. When the ticket is created in Jira, a pop-up window appears in VRM that includes a link to the ticket.