SaaS Security Administrator's Guide
    : Begin Scanning a Jira Data Center App
    Focus
    Download PDF
    Focus
    1. Home
    2. SaaS Security
    3. SaaS Security Administrator's Guide
    4. Data Security
    5. Secure Sanctioned SaaS Apps on Data Security
    6. Add Cloud Apps to Data Security
    7. Begin Scanning a Jira Data Center App
    Download PDF

    SaaS Security Administrator's Guide

    Begin Scanning a Jira Data Center App

    Table of Contents

    Begin Scanning a Jira Data Center App

    Authorize Data Security to connect to Jira Data Center to scan all content shared within the app.
    To connect a Jira Data Center app and begin scanning assets, you need to:
    • Ensure that you add your region-specific IP addresses to the allowed list so that firewalls don’t block them.
    • Ensure that you have a Jira Data Center Administrator account with workspace-level permissions.
    • Grant Data Security access to Jira Data Center.
    • Add the Jira Data Center app to Data Security, providing Data Security information about your Jira Data Center account.
    Support for automated remediation capabilities varies by SaaS application.

    Add Jira Data Center App

    In order for Data Security to scan assets, you must consent to specific permissions during adding the Jira Data Center app.
    1. (Recommended) Add your Jira Data Center domain as an internal domain.
    2. Log on to SaaS Security.
    3. To add the Jira Data Center app, go to Data SecurityApplicationsAdd ApplicationJira Data Center.
    4. Sign in to the Atlassian workspace with an account that has workspace-level Administrator permissions.
    5. Follow the onscreen instructions in Step 1: In Jira Data Center, navigate to Jira settings (cog icon) > Applications > Application links > Create Link.
    6. Follow the onscreen instructions in Step 2: In the Create Link page, ensure that Atlassian product is selected. Enter the tenant home page address. Ignore the No response warning, and click Continue.
    7. Follow the onscreen instructions in Step 3: In the Link applications page, enter the Application Name as Palo Alto Networks CASB.
    8. Follow the onscreen instructions in Step 4: Choose the Application Type as Generic application from the drop-down.
      Because you are only retrieving data from Jira, you only need to set up a one-way (incoming link) communication for the client to Jira. You can leave all other input fields blank.
    9. Follow the onscreen instructions in Step 6: Select the Create incoming link check box. Click Continue.
    10. Follow the onscreen instructions in Step 7: The following consumer details for the client are provided in your wizard:
      • Consumer key
      • Consumer name
      • Public key
    11. Follow the onscreen instructions in Step 8: Add your region-specific IP addresses to the allowed list so that firewalls don’t block them.
    12. Follow the onscreen instructions in Step 9: To onboard your Jira instance on the Data Security platform, you must provide access to your Jira instance. To do that, enter your Server URL and click Add to Jira.
    13. Follow the onscreen instructions in Step 10: To setup Webhooks, go to Jira administration console > System > Webhooks (in the Advanced section).
    14. Follow the onscreen instructions in Step 11: Click Create a WebHook and complete the form with the following values:
      • Name: SaaS Security webhook
      • Status: Enabled
      • URL: Enter the URL that you see in the wizard
      • Subscribe to the following events and click Create:
        • Issue: created, updated, deleted
        • Comment: created, updated, deleted
        • Project: created, deleted
    15. After onboarding is complete, Data Security adds the new Jira Data Center app to the list of Cloud Apps as Jira Data Center n, where n is the number of Jira Data Center app instances that you have connected to Data Security. You’ll specify a descriptive name soon.

    Customize Jira Data Center App

    After you add the Jira Data Center app, customize the app to make use of capabilities that are unique to this app or that differentiate this app instance from others.
    1. (Optional) Give a descriptive name to this app instance.
      1. Select the Jiran link on the Cloud Apps list.
      2. Enter a descriptive Name to differentiate this instance of Jira Data Center from other instances.
      3. Click Done to save your changes.
    2. Next step: Proceed to Identify Risks.

    Identify Risks

    When you add a new cloud app, then enable scanning, Data Security automatically scans the cloud app against the default data patterns and displays the match occurrences. You can take action now to improve your scan results and identify risks.
    1. To start scanning the new Jira Data Center app for incidents, go to Data SecurityApplicationsJira Data CenterEnable Scanning.
    2. Monitor the scan results.
      During the discovery phase, as Data Security scans files and matches them against enabled policy rules:
      • Verify that Data Security displays assets.
      • Verify that your default policy rules are effective. If the results don’t capture all risks or you see false positives, proceed to next step to improve your results.
    3. (Optional) Modify match criteria for existing policy rules.
    4. (Optional) Add new policy rules.
      Consider the business use of your cloud app, then identify risks unique to your enterprise. As necessary, add new:
    5. (Optional) Configure or edit a data pattern.
      You can Configure Data Patterns to identify specific strings of text, characters, words, or patterns to make it possible to find all instances of text that match a data pattern you specify.
    6. Next step: Proceed to Fix Jira Data Center App Onboarding and Scan Issues, if necessary.

    Fix Jira Data Center App Onboarding and Scan Issues

    The most common issues related to onboarding a Jira Data Center app are as follows:
    Symptom
    Explanation
    Solution
    Attachments embedded in comments don’t display in SaaS Security web interface.
    Attachments embedded inside descriptions or comments are not currently supported—only attachments added through the attach button are scanned for violations.
    This is expected behavior. However, periodically monitor the support because new support is added regularly.
    Attachments embedded in descriptions don’t display in SaaS Security web interface.
    Primary Email of the asset owner related to Jira app doesn’t display in the SaaS Security web interface.
    Sometimes users explicitly block outsiders (apps or people) from viewing their contact information, which includes email address.
    Set Contact Email address to Anyone to display this information.
    From Profile and visibility, navigate to ContactEmail addressWho can see this? and enable Anyone.
    Comments for user activity and events display in the SaaS Security web interface, but one comment appears to be a duplicate of another as the Target Name for each is the same.
    All comments have a unique Target Name. However, the SaaS Security web interface only displays the first 16 characters for optimal viewing as some names can be quite long.
    This is expected behavior and by design.

    FAQs for Jira Data Center App

    The most common questions related to onboarding a Jira Data Center app are as follows:
    Question
    Answer
    What are the different events or activities supported for Jira Data Center app?
    Create and delete of issues, projects, comments, and attachments.
    Delete is defined as permanently deletion. See Fix Jira Data Center App Onboarding and Scan Issues.
    How are Issue description violations named?
    They are named using the format Issue: {issue-key}.
    How are Issue comment violations named?
    They are named using the format `Comment: {issue-key}.
    How are Issue attachment violations named?
    They are named using the format `Attachment: {attachment-name}.
    How do I search for all assets related to a Jira Issue?
    You can retrieve assets as follows:
    • Description violations and comment violations—Type the Issue-Key
    • Attachment violations—Search by attachment name or by application name.

    © 2024 Palo Alto Networks, Inc. All rights reserved.