Jira

What it covers

Open security tickets have an assigned owner; create remediation tickets from findings.

Credential to create

Atlassian API token + your account email (used as Basic auth)

Create an API token

Permissions to grant

• Browse projects on the security project (reads open security tickets)
• Create issues in the project you choose (only if you generate remediation tickets)

Setup steps

1. Create an Atlassian API token for a user with access to your security project.
2. Enter your Base URL (https://your-site.atlassian.net), the account email, and paste the token.
3. Set the JQL that selects your open security tickets. The default assumes tickets are labeled 'security'; change it to match your team.

Notes and gotchas

• If your team does not label tickets 'security', set the JQL field or the control has nothing to measure and will pass on an empty result.