Integrating Acunetix 360 with Jira

Integrating Acunetix 360 with Jira helps to streamline your bug-fixing process and vulnerability management. Any vulnerability that needs fixing must be turned into a Jira ticket and automatically assigned to developers.

Other advantages of integrating Acuneetix 360 with Jira include the ability to:

  • Monitor the vulnerability-fixing process
  • Verify fixes (if there is 2-way integration)
  • Reopen tickets, if necessary
  • Close tickets


This article explains how to set up an integration between Acunetix 360 On-Demand and Jira, how to export issues from Acunetix 360 to Jira, and how to register a webhook for 2-way integration.  

Warning:

If you are using the self-hosted Jira, first make sure Acunetix 360 On-Demand can communicate with the self-hosted Jira.

Prerequisite

  • Administrator privileges OR the Add/Edit Integration permission in Acunetix 360.

There are two steps to this integration:

  1. Setting up the connection with Jira
  2. Configuring project details for integration

Step 1: How to set up the connection with Jira

  1. Log in to Acunetix 360.
  2. From the main menu, go to Integrations > New Integration > Jira.

  1. In the Mandatory section, complete the connection details:
  1. Name: This is the name of the integration that will be shown elsewhere in Acunetix 360.
  2. URL: This is the Jira URL. The URL must be specified as the domain name.
  3. Username or Email: This is the username if self-hosted. If hosted by Atlassian, use the email address.
  4. Access Token or Password: This is the access token (API) or the password of the user. If hosted by Atlassian, enter the API token. If self-hosted, enter your password. The API token can be retrieved from: https://id.atlassian.com/manage/api-tokens.
  1. Select Load Jira Details.

If successful, Acunetix 360 displays your project details to continue configuring your integration. Otherwise, Acunetix 360 displays an error message.

Step 2: How to configure your Jira project for integration with Acunetix 360

  1. From the Project Key drop-down, choose your project. Alternatively, start typing your project name or project key to search, then choose your project from the search results.

  1. From the Issue Type drop-down, choose the issue type. (For further information about issue types, refer to the Jira support documentation: What are issue types?)
  2. Enter the Title Format. This is the string format that is used to create the issue title. You can leave it as it is or type your title format including {0}.
  3. Choose a template type for the issue description: Standard (fewer issue fields) or Detailed (more issue fields such as Request and Response).
  4. Select Save to save your integration.


Once saved, the integration appears on the Manage Integrations page. You can test your integration by creating a sample issue.

Information:

You can further configure your integration, for example, by selecting the assigned person or determining the due date. For further information, refer to the Configuring custom and complex fields section of this article.

Creating a sample issue to test integration

  1. From the main menu, select Integrations > Manage Integrations.
  2. From the Manage Integrations page, next to the relevant Jira integration, select Edit.
  3. Click Create Sample Issue.

Acunetix 360 exports a sample issue to Jira to test the integration. If successful, the following ticket is opened in Jira:

How to edit the Jira integration

  1. From the main menu, select Integrations > Manage Integrations.
  2. Next to the relevant Jira integration, select Edit.
  3. Make the necessary changes, and click Save.

How to delete the Jira integration

  1. From the main menu, select Integrations > Manage Integrations.
  2. Next to the relevant Jira integration, select Delete.
  3. From the Delete Integration pop-up, click Delete.

How to clone the Jira integration

Tip:

You can clone your integration to create as many Jira integrations as you need. However, due to security precautions, access tokens or passwords cannot be cloned.

  1. From the main menu, select Integrations > Manage Integrations.
  2. Next to the relevant Jira integration, select Clone.
  3. Make the necessary changes, then click Save.

Exporting issues to Jira

This section outlines the various ways you can send issues from Acunetix 360 to Jira.

Notifications after scanning

Once the integration has been configured, you can configure Acunetix 360 to automatically send issues to Jira after scanning has been completed. For further information, refer to Managing Notifications.

Issues page

  1. From the main menu, select Issues > All Issues.
  2. On the Issues page, select one or more issues you want to send.
  3. Select Send To > Jira.

A pop-up is displayed, with a link to the issue you have sent to Jira. If there is an error, this information will be displayed instead.

Recent Scans page

  1. From the main menu, select Scans > Recent Scans.
  2. Next to the relevant scan, select Report.
  3. Scroll down to the Technical Report section.
  4. From the list of detected issues, select an issue and display its details.

  1. Select Send To > Jira.

You can view the issues you have sent to Jira on the Open issues page.

If you have already previously submitted this vulnerability to Jira, it will already be accessible. You cannot submit the same issue twice.

Registering webhook for 2-way integration

Warning:

We updated the webhook configuration for the 2-way integration on 23 May 2023. To ensure the integration continues to work, enable the Exclude Body checkbox on the Jira webhook settings. This update is essential for maintaining the full functionality of the integration.

  • If you have already enabled the Exclude Body checkbox, then no action is needed on your part.
  • If you have not yet done so, please go to the Jira webhook settings, enable the checkbox, and save the configuration. This will ensure you can continue using the 2-way integration.

Acunetix 360 has out-of-the-box support for resolving and reactivating Jira issues according to the scan results, in addition to automatic issue creation. Acunetix 360 uses user-provided Resolved and Reopened statuses in Jira for this purpose.

To enhance issue synchronization support, Acunetix 360 also offers webhook support. This enables you to detect any status changes in Jira issues opened by Acunetix 360. This can help you:

  • Streamline issue resolution
  • Cut down on communication overhead
  • Allow developers to work on vulnerabilities without leaving the Jira environment

Acunetix 360 generates a Webhook URL after you save your integration settings. When you register this link as a webhook in your Jira project and enter your preferred Resolved and Reopen statuses, you complete Acunetix 360 issue synchronization for your integration.

When you change your Jira issue’s status to your preferred Resolved status, the issue is automatically marked as Fixed (Unconfirmed) in Acunetix 360 and a retest scan is started. And, when you change your Jira issue’s status to your preferred Reopened status, your corresponding Acunetix 360 issue is automatically marked as Revived.

The Webhook Settings field

This table lists and explains the Webhook fields on the Update Jira Integration page in Acunetix 360.

Button/Section/Field

Description

Webhook URL

This is the URL you need to enter to Jira to create the 2-way integration.

Reopen Status

This is the status of the reopened issues or tickets. This can be: To Do or In Progress.

Resolved Status

This is the status name of the resolved issues or tickets. By default, it is Done.

Information:

In Jira, the Reopen status can only be mapped to two categories: To Do and In Progress.

The Resolved status, however, can be mapped to any workflow step from your Jira workflow configuration. To avoid issues, ensure that the workflow steps for the Reopen and Resolved statuses are not the same.

Other categories added afterwards are referred to as aliases and these values cannot be used for integration with Acunetix 360. Pay attention to the category definitions when defining your workflow.

IMPORTANT INFORMATION FOR AVOIDING TESTING LOOPS

If you do not want accepted risk or false positive issues to be reopened and retested, make sure the Jira case is not closed using any of the resolved workflow steps used for the Resolves status.

Alternatively, you can create a dedicated workflow (name suggestion would be ‘false positive’ or ‘accepted risk’) step in Jira for false positives that does not overlap with the workflow steps used for the Resolved status in Acunetix 360.

Using the same workflow step for both false positives and resolved issues can lead to a testing loop. The vulnerability would be manually marked as a false positive – Fixed (Unconfirmed) – then retested in the next scan. The vulnerability reappears, gets marked as a false positive again, and is closed manually. The Jira case is reopened, repeating the cycle.

How to register an Acunetix 360 Jira Integration Webhook

  1. From the main menu, select Integrations > Manage Integrations.
  2. Next to the relevant Jira integration, select Edit.
  3. From the Webhook Settings section, select Copy to clipboard to copy the Webhook URL.

  1. In a separate window, go to Jira.
  2. From the main menu, go to  Settings > System > WebHooks.
  3. On the WebHooks page, select Create a WebHook.

  1. In the URL field, paste in the Webhook URL (from step 3).

  1. In the Issue-related events section, enter the Jira project name that the webhook configuration is for. If you do not define this field, then change requests for all your Jira projects will come to Acunetix 360.

  1. In the Issue-related events section, select the updated checkbox in the Issue column.
  2. In the Jira WebHooks settings page, select the Exclude body checkbox. If you do not enable this checkbox, the WebHooks configuration will not work.

  1. Select Create.

Warning:

After creating a webhook URL and entering it into Jira, if you modify your project details and save it, this changes the webhook URL. Therefore, you need to copy the new webhook URL and paste the new URL into Jira. If you do not do this, your 2-way integration will not work.

Configuring custom and complex fields

You can customize your Jira integration thanks to custom and complex fields. For example, you can choose the person who will be responsible for issues identified by Acunetix 360. Or, you can choose the priority level for the issue. You can delete custom fields available or add new fields based on your needs.

Jira field mappings

This table lists and explains the default Jira field mappings on the Jira Integration page in Acunetix 360.

Information:

The following fields appear by default in the drop-down. There may be additional fields based on your project and issue type.

Button/Section/Field

Description

Assigned to

This is the user to whom the issue is assigned by default.

Reporter

This is the user who reports issues.

Labels

These are the issue labels.

Components

These are the components that you need to create on Jira. You can learn more about the components via the Jira support site.

Typing component names provides the list of component(s) that you can select. You can select more than one component.

Security Level

This is the issue security level. You need to define this level in Jira, so you can control which user or group of users can view an issue. If there is no level defined, "No research found" is displayed. For further information, refer to Configuring issue-level security.

Due Days

This is the number of days from the date the issue was created to the date it is due.

Priority

This is the priority of the issue. This is mapped between Acunetix 360 and Jira. You can map an Acunetix 360 priority level to Jira priority. For example, you can configure a high priority in Acunetix 360 to the highest priority in Jira.

If you don't map any priority level, Acunetix 360 sends all issues as "medium". If you mapped one level, for example, the highest, the rest of the issues will be sent as the medium.

Epic Link

This is an epic key. You need to copy the epic key from Jira and paste it into this field.

Epic Name

This is the epic name. You can write any name you want. Acunetix 360 creates this epic name in Jira. When you send any issue, including sample issue creation, Acunetix 360 creates the epic name in Jira.

The epic name option appears only if you select the issue type as Epic.

Please note that you cannot select an epic name and epic link for the same integration.

How to add a new custom field

  1. From the Jira Field Mappings section, select + New Jira Field.
  2. From the Field Name drop-down, select a value. (For this example, we selected Priority.)

  1. From the Acunetix 360 Security drop-down, select Critical.
  2. From the Jira Value drop-down, select Highest.
  3. Click Save.

How to configure complex fields

In addition to custom fields, your project can include complex fields, such as date picker. Mapping complex fields need to be entered using double quotes or square brackets.

  1. From the Jira Field Mappings section, select + New Jira Field.
  2. From the Field Name drop-down, select a value. (For example, Date Picker.)
  3. Enter the Jira Value. (For example, "2022-07-28".)

  1. From the Jira Field Mappings section, select + New Jira Field.
  2. From the Field Name drop-down, select a value. (For example, Release Version.)
  3. Enter the Jira Value. (For example, ["22-9", "22-9-1"].)

  1. From the Jira Field Mappings section, select + New Jira Field.
  2. From the Field Name drop-down, select a value. (For example, Caution.)
  3. Enter the Jira Value.  (For example, This is a sample issue.).

  1. Select Create Sample Issue.

If successful, Acunetix 360 displays a success message and a link to the ticket.

You can view the issue you have sent to Jira in the following way:

 

« Back to the Acunetix Support Page