Configure Jira Templated Connection

You can configure a templated connection in the Alert Logic console to send notifications to Jira. When you set up a notification and subscribe a templated connection, Alert Logic sends the event to the URL you configured and generates an issue in Jira automatically.

Alert Logic notifications alert you to threats, changes, and scheduled events in your environment so you can respond quickly. From the Alert Logic console, you can subscribe your Jira templated connection to receive:

Complete the following steps to successfully generate issues in Jira:

  1. Identify the connection
  2. Identify your Jira URL path
  3. Customize the payload template
  4. Create the Jira templated connection from the Alert Logic console
  5. Subscribe your templated connection to receive notifications

Identify the connection

This templated connection requires a Jira connection, which stores authentication and credential information that grants Alert Logic access to Jira. If you do not have the connection already, you can create it now or when you create the templated connection.

For more information, see Configure Jira Connection.

Identify your Jira URL path

The Alert Logic console provides the default URL path that Jira requires for ticket creation. The URL path is added to the base URL in the connection to define the full URL. Advanced API integration targeting can be done by modifying the URL path.

Customize the payload template

Decide which type of security information that you want Alert Logic to send to Jira: Incident, Observation (of a log correlation), Scheduled Report Notification, or Health Notification payload.

If you want to send more than one payload type, you must configure a templated connection for each one. Because the payload is different, each payload type requires a separate templated connection instance.

Alert Logic provides a template for each payload type using JQ transformation. A payload template converts the Alert Logic security information to the format expected by Jira. You can add or remove lines in the sample template to meet your workflow requirements and security goals. You must replace placeholder information in angle brackets with valid values.

For definitions of the Alert Logic variables in the templates and the full JSON that you can use to configure your payload template in JQ or JSON format, see:

For more information about JQ, see JQ. A helpful website for converting JSON to JQ is jq play.

Incident payload template

Copy

JQ Template

{
    "fields": {
        "reporter": {
            "id": "<REPORTER ID>"
        },
        "issuetype": {
            "name": "Task"
        },
        "project": {
            "key": "<PROJECT KEY>"
        },
        "summary": .incident.summary,
        "description": {
            "type": "doc",
            "version": 1,
            "content": [
                {
                    "type": "paragraph",
                    "content": [
                        {
                            "text": .incident.description,
                            "type": "text"
                        }
                    ]
                },
                {
                    "type": "paragraph",
                    "content": [
                        {
                            "type": "text",
                            "text": "Link to the incident",
                            "marks": [
                                {
                                    "type": "link",
                                    "attrs": {
                                        "href": .extra.incidentUrl
                                    }
                                }
                            ]
                        }
                    ]
                }
            ]
        },
        "priority": {
            "name": (if .incident_threat_rating == "Critical" then "Highest" elif .incident_threat_rating == "High" then "High" elif .incident_threat_rating == "Medium" then "Medium" else "Low" end)
        }
    }
}

Observation payload template

Copy

JQ Template

{
    "fields": {
        "reporter": {
            "id": "<REPORTER ID>"
        },
        "issuetype": {
            "name": "Task"
        },
        "project": {
            "key": "<PROJECT KEY>"
        },
        "summary": .fields.summary,
        "description": {
            "type": "doc",
            "version": 1,
            "content": [
                {
                    "type": "paragraph",
                    "content": [
                        {
                            "text": ("Description: " + .fields.desc),
                            "type": "text"
                        },
                        {
                            "text": ("Recommendations: " + .fields.recommendations),
                            "type": "text"
                        },
                        {
                            "text": ("Class: " + .fields.class),
                            "type": "text"
                        },
                        {
                            "text": ("Subclass: " + .fields.subclass),
                            "type": "text"
                        }
                    ]
                }
            ]
        },
        "priority": {
            "name": (if .fields.severity == "critical" then "Highest" elif .fields.severity == "high" then "High" elif .fields.severity == "medium" then "Medium" else "Low" end)
        }
    }
}

Scheduled Report Notification payload template

Copy
JQ Template
{
    "@context": "https://schema.org/extensions",
    "@type": "MessageCard",
    "themeColor": "0072C6",
    "title": "Alert Logic Scheduled Report Completed",
    "summary": "Scheduled Report Completed Card",
    "sections": [
        {
            "activityTitle": .name,
            "activitySubtitle": ("Type: " + .artifact_data.metadata.report_type + " | Customer: " + .artifact_data.metadata.customer_name + " | Customer ID: " + .account_id),
            "facts": [
                {
                    "name": "Cadence",
                    "value": .artifact_data.metadata.cadence
                },
                {
                    "name": "Created On",
                    "value": .artifact_data.metadata.artifact_create_date
                }
            ],
            "text": .artifact_data.metadata.report_description
        }
    ],
    "potentialAction": [
        {
            "@type": "OpenUri",
            "name": "View Report",
            "targets": [
                {
                    "os": "default",
                    "uri": .extra.ui_url
                }
            ]
        },
        {
            "@type": "OpenUri",
            "name": "Download Report",
            "targets": [
                {
                    "os": "default",
                    "uri": .extra.download_url
                }
            ]
        }
    ]
}

Health Notification payload template

Copy
JQ Template
{
    "@context": "https://schema.org/extensions",
    "@type": "MessageCard",
    "themeColor": "0072C6",
    "title": "Alert Logic Health Notification",
    "summary": ("Remediation ID: " + .remediation_id + " | " + .report_description),
    "sections": [
        {
            "activityTitle": .report_description,
            "activitySubtitle": ("Customer: " + .customer_account_name + "| Account ID: " + .cid),
            "facts": [
                {
                    "name": "Resolution",
                    "value": .resolution
                },
                {
                    "name": "Remediation Id",
                    "value": .remediation_id
                },
                {
                    "name": "Deployment",
                    "value": .deployment_name
                },
                {
                    "name": "Target Asset Type",
                    "value": .target_asset_type
                },
                {
                    "name": "Exposure Impact",
                    "value": .exposure_impact
                }
            ],
            "text": (.report_description + " | " + .resolution)
        }
    ]
}

Create the Jira templated connection from the Alert Logic console

The next step is to create the templated connection in the Alert Logic console and test the payload.

To create a Jira templated connection:

  1. In the Alert Logic console, click the navigation menu icon (), click Configure, and then click Connections.
  2. Click the Templated Connections tab.
  3. On the Templated Connections page, click the add icon (), and then click Jira.
  4. On the Create a Jira Templated Connection page, type a descriptive name for the templated connectionfor example, "Jira Templated Connection for Incidents."
  5. In Connection, select or create a Jira connection.
  6. In URL Path, leave the information as is. The field is prepopulated with the URL path that Jira requires.
  7. (Optional) In Additional Header(s), enter any custom HTTP request headers your integration requires, in addition to the ones defined in the Jira connection, as HTTP header name-value pairs. Each header must be on a separate line.
  8. Select the Payload Type, which is the type of Alert Logic security information that you want to send: Incident, Observation (of a log correlation), Scheduled Report Notification, or Health Notification.
  9. Select the format of the payload template you customized earlier: JSON or JQ.
  10. Select an HTTP verb for the templated connection payload. If you are unsure, leave it as the default verb: POST.
  11. In the Payload Template area, enter the payload template that you customized.
  12. A red bar next to a line indicates a syntax error. Code with errors is underlined with a jagged red line. You can hover your pointer over the underlined code to view a tip about the error.
  13. Click TEST to send a test event to the URL provided. For more information about test results, see the next section.
  14. If your templated connection sent the test event to the URL successfully, click SAVE.

Test results

If you receive a message that the templated connection was successfully tested, Alert Logic sent the payload template you configured and populated an issue in Jira with sample data. Check Jira to ensure the results are expected, and adjust the payload template if necessary.

If the test is unsuccessful, Alert Logic displays an error message. For server response errors, you can use the error code and message that Alert Logic passes through to troubleshoot the issue. Alert Logic also informs you if your JSON or JQ payload template contains syntax errors.

Subscribe your templated connection to receive notifications

After you test and save the templated connection configuration, the last step is to set up your notification criteria and subscribe the templated connection.

You can set up and manage a notification of any type directly from the Notifications page. For more information, see Manage Notifications. You can create notifications from other pages according to notification type:

  • For incidents, you can also create a notification from the Incidents page. For more information, see Incident Notifications.
  • For observations, you can also create a notification from the Search page (Log Search tab or Correlations tab) during the process of creating the correlation or by editing an existing correlation listed on the Correlations tab. For more information, see Correlations and Notifications and Observation Notifications.
  • For health exposures, you can also create a notification from the Health page. For more information, see Health Notifications.
  • For scheduled reports, you can also schedule the report and subscribe notification recipients from the Reports page. For more information, see Scheduled Reports and Notifications.

Manage your templated connections

You can view the list of templated connections and edit or delete an existing one. For more information, see Manage Templated Connections.