Connect Safeguard to Jira Cloud: issues, status mapping and sync

A finding that lives only in a security console tends to wait. The Jira integration puts it where engineers already work. This guide follows the Safeguard Jira integration page.

What it is

The Jira card connects Safeguard to one Jira Cloud project. Safeguard creates Jira issues for the findings and work you send to Jira, updates them, and moves them through your workflow using a status mapping you set. Jira Data Center is not supported yet, and there is no sign in with Atlassian (OAuth) yet: the connection uses an Atlassian API token.

How to use it

First create the credential in Atlassian. Open the API tokens page of your Atlassian account and choose Create API token, or Create API token with scopes, pick Jira and select read:jira-user, read:jira-work and write:jira-work. Give it a name and an expiry date, then copy it; Atlassian shows it only once. Your Atlassian password does not work, and neither does a Data Center personal access token.

The account behind the token needs Browse projects, Create issues, Edit issues and Transition issues on the project. Assign issues and the global Browse users and groups permission are optional and only matter if you set a default assignee. Safeguard never needs Jira administrator rights or delete permissions, and it never deletes issues, projects or users. The guide suggests a dedicated Jira account limited to the one project.

Then connect it in Safeguard.

1. Open Integrations and choose the Notification tab.
2. Click Connect on the Jira card.
3. Enter a Name. Under Where does Jira run?, keep Cloud and enter your Site URL, such as https://your-site.atlassian.net. For a scoped token, enter https://api.atlassian.com/ex/jira/<cloudId> instead.
4. Paste the token into Jira Token and the account email under Username. A Default Assignee email and a Description are optional.
5. Click Next. "Jira connection validated successfully" means Jira accepted the token. Choose the project under Select Project.
6. Under Status Mapping, map Safeguard's states (new, in progress, under review, completed) to your Jira statuses, then click Connect.

Atlassian API tokens expire after 1 to 365 days, one year by default. When the token expires, issue creation and sync stop until you paste a new one, so put the date in your calendar.

What Safeguard sends

Safeguard sends issue titles, descriptions and status changes about your Safeguard findings. It reads the token's account, your projects, the chosen project's statuses and the issues it created, and it stores the connection settings, the project and status mapping, the links between Safeguard items and Jira issues, and the API token, encrypted at rest. The setup guide does not describe automatic trigger rules or custom field mapping, so plan around the findings and work you choose to send.

Status sync

Sync runs on the issues Safeguard created. Safeguard pushes its own changes to those issues and moves them to the Jira status you mapped. To pick up changes made in Jira, it checks those issues every few minutes, so there are no webhooks to set up. If issues are not created or do not move, the account usually lacks Create issues, Edit issues or Transition issues on the project.

Rotate or disconnect

To rotate, create a new API token, open the Jira connection on the Notification tab, choose Update, paste the new token and save, then revoke the old token in Atlassian. To disconnect, choose Delete on the connection and revoke the token. Issues already created stay in Jira.

Quick check

Sources

• Safeguard docs: Jira
• Atlassian: Manage API tokens for your Atlassian account