Connecting Security Operations Management to Jira
Perform the following procedures to connect Security Operations Management to your Jira instance.
Credentials and Initial Setup
1.Log into ITSM as an Administrator and open the Ticket Sharing and Synchronization (TSS) workspace.
2.Select New Ticket Sharing and Synchronization.
3.Enter the Integration Name (example: Jira).
4.Select Incident from the Business Object Name menu.
5.Select Enabled from the Status menu.
6.In the Service Name field, find and select Jira.
7.Save.
8.Four new tabs now appear after the Credentials tab: Filters, Field Mapping, Data Mapping, and Data Rules.
9.The Credentials tab now contains three additional fields:
Service URL: Relevant Jira instance URL (example: https://customer version.atlassian.net/rest/api/2).
Username: Jira account username (example: [email protected]).
Auth Token: Token provided by Jira (example: Token1232323232323).
10. Save.
Filters Tab
1.In the Filters tab, click New Connector Service Filters.
2.In the New Connector Service Filters dialog, select Summary from the Incident Field Name menu.
3.In the Incident Field Value field, enter Trojan.
4. Operation with next Filter determines how filtering works with other filters. Select the appropriate operator (AND or OR) (example: add a “Ransomware Detected” filter).
5.When all appropriate filters have been added, Save.
Field Mapping Tab
1.In the Field Mapping tab, click New Connector Service Field Mapping.
In the New Connector Service Field Mapping dialog, select Urgency for the Incident Field Name.
Enter priority for the Jira Field Name. This field is in lowercase in Jira.
Select Poll this field for any changes.
Save.
2.Click New Connector Service Field Mapping.
In the New Connector Service Field Mapping dialog, select Summary for the Incident Field Name.
Enter summary for the Jira Field Name . This field is in lowercase in Jira.
Enter summary for the Service Field Depth.
Select Poll this field for any changes.
Save.
3.Click New Connector Service Field Mapping.
In the New Connector Service Field Mapping dialog, select Provide default value (to switch field mapping from Jira to ISM).
Enter project for the Jira Field Name.
Enter ESM for the Default Value.
Enter project^key for the Service Field Depth.
Save.
4.Click New Connector Service Field Mapping.
In the New Connector Service Field Mapping dialog, select Description for the Incident Field Name.
Enter description for the Jira Field Name. Note: This field is in lowercase in Jira.
Enter description for the Service Field Depth.
Save.
5.Click New Connector Service Field Mapping.
In the New Connector Service Field Mapping dialog, select Status for the Incident Field Name.
Enter status for the Jira Field Name. Note: This field is in lowercase in Jira.
Select Poll this field for any changes.
Save.
6.Click New Connector Service Field Mapping.
In the New Connector Service Field Mapping dialog, select Provide default value (to switch field mapping from Jira to ISM).
Enter issuetype for the Jira Field Name.
Enter Task for the Default Value.
Enter issuetype^name for the Service Field Depth field.
Save.
Data Mapping Tab
1.In the Data Mapping tab, click New Connector Service Data Mapping.
In the New Connector Service Field Mapping dialog, select Incident=Urgency :: Jira=priority for the Connector Service Field.
Enter Low for the Incident Field Value.
Enter Low for the Jira Field Value.
Save.
2.Click New Connector Service Data Mapping.
Select Incident=Urgency :: Jira=priority for the Connector Service Field.
Enter Low for the Incident Field Value.
Enter Lowest for the Jira Field Value.
Save.
3.Click New Connector Service Data Mapping.
Select Incident=Urgency :: Jira=priority for the Connector Service Field.
Enter High for the Incident Field Value .
Enter High for the Jira Field Value.
Save.
4.Click New Connector Service Data Mapping.
Select Incident=Urgency :: Jira=priority for the Connector Service Field.
Enter High for the Incident Field Value..
Enter Highest for the Jira Field Value.
Save.
5.Click New Connector Service Data Mapping.
Select Incident=Urgency :: Jira=priority for the Connector Service Field.
Enter Medium for the Incident Field Value.
Enter Medium for the Jira Field Value.
Save.
6.Click New Connector Service Data Mapping.
Select Incident=Status:: Jira=status for the Connector Service Field.
Enter Active for the Incident Field Value.
Enter In Progress for the Jira Field Value.
Save.
7.Click New Connector Service Data Mapping.
Select Incident=Status:: Jira=status for the Connector Service Field.
Enter Logged for the Field Value.
Enter To Do for the Jira Field Value.
Save.
8.Click New Connector Service Data Mapping.
Select Incident=Status:: Jira=status for the Connector Service Field.
Enter Closed for the Incident Field Value.
Enter Done for the Jira Field Value.
Select Stop polling after this value.
Save.
Data Rules Tab
1.In the Data Rules tab, select New Connector Service Field Constraint.
In the Field Mapping Value menu, select Incident=Status :: Jira=Status[Closed,Done].
In the Business Object Field Name menu, select CauseCode.
Enter Hardware for the Business Object Field Value.
Save.
2.Click New Connector Service Field Constraint.
In the Field Mapping Value menu, select Incident=Status :: Jira=Status[Closed,Done].
In the Business Object Field Name menu, select Resolution.
Enter Completed for the Business Object Field Value.
Save.
Additional Operations
1.Click the Additional Operations tab. If the tab is not visible, you may have to refresh or go to List View and select your TSS again.
2.Select the following options:
•Push Comments added in HEAT to Jira
•Pull Comments added in Jira to HEAT
•Push Attachments added in HEAT to Jira
•Pull Attachments added in Jira to HEAT
3.In the Comment Business Object menu, select Journal#Notes.
4.Save.
Comment Field Mapping
1.Click the Comment Field Mapping tab. If the tab is not visible, you may have to refresh or go to List View and select your TSS again.
2.Click New Comment Field Mapping.
In the Incident Field Name menu, select Notes.
Enter Description for the Jira Field Name.
Save.
3.Click on New Comment Field Mapping.
In the Incident Field Name menu, select Source.
Leave the Jira Field Name blank.
Enter Other for the Incident Default Value.
Save.
4.Click on New Comment Field Mapping.
In the Incident Field Name menu, select Subject.
Enter Summary for the Jira Field Name.
Save.