Jira

This is a feature that allows you to send vulnerabilities from Faraday to JIRA. Through this process you will see how to

JIRA's Configuration¶

1. Follow the instructions based on you JIRA Instance (On-prem or Cloud)¶

JIRA On Prem Software

Copy your instance URL and Project Key from your JIRA instance information:

URL (example): https://localhost:8080/

Project Key (example): FARADAYPRO

JIRA Cloud

Copy your JIRA Instance URL and Project Key information:

URL (example): https://example.atlassian.net/

Project Key (example): FARADAYPRO

Now, we need to activate OAuth Authentication:

Inside your JIRA Cloud click on the gear icon at the top-right corner (left side of your profile icon) and click on Products, then, on the left-side bar, click on Application links

On the input bar at JIRA, enter your Faraday's URL (example: http://localhost:5985)

If this message appears and the URL is correct, just click Continue

Fill the application fields, in this case, Faraday as the Application Name, you must select the option Generic Application as the Application Type and Mark the option Create incoming link. Then, click Continue.

Now, you will need to create a:

Consumer Key: you should copy and save this for after configuration at Faraday.
Consumer Name: In this case, we use Faraday.

Public Key: To create this Public Key, you will need to execute the following command on your Faraday Server: faraday-manage generate-rsa-keys --integration jira you will receive something like this:

Just copy and paste it inside your Publick Key field at JIRA.

Then, click Continue to generate the application.

If everything is Ok, you should see this screen:

Faraday authenticates to Jira using OAuth 1.0 A

3. Faraday's Configuration¶

Login into Faraday's Web UI and go to Setting clicking on your username in the top right corner:

Inside Settings, navigate to Ticketing Tools and Select JIRA from the dropdown menu:

JIRA On-Premise¶

Paste your JIRA instance information inside configuration and paste it on the correct fields.

Save the instance url, project key, and generate the key to use it in the Oauth configuration.

If everything is Ok, click on the blue Save button.

JIRA Cloud¶

Inside the ticketing tool at Faraday, paste your instance URL and Project Key, then, add your **Consumer Key** into the OAuth Authentication field, after this, click the round button to authenticate!

![](./images/integrations/jira/authorize-faraday.png)

You should see this, **click on Redirect to JIRA**, once on JIRA website, **click on Allow** and wait until receive an Access Approved message, once received, close the tab.

![](./images/integrations/jira/jira-website.png)

![](./images/integrations/jira/approved-message.png)

Once in Faraday, click on Authorized.

![](./images/integrations/jira/oauth-succeed.png

Configure jira users in faraday¶

Inside Preferences, navigate to Ticketing Tools and Select JIRA:

Search Jira users from the Assign Users box and hit enter:

If the user is added correctly, then the user will be allowed to be reporter in the "reporters" field.

User added correctly!

4. Send vulnerability to JIRA¶

Navigate to the Manage > Vulns view inside Faraday's Web UI

To send vulnerabilities to JIRA, select the desired vulnerabilities, click on the Tools button at the top-right corner and then click on JIRA.

Click on the dropdown menu Add columns and add the issuetracker column.

Now, select the vulnerability you want to export and click on Tools > JIRA

Keep in mind that only confirmed vulnerabilities can be sent.

Once the JIRA dialog opens, you have two options:

You can use the default data saved in the Ticketing Tools section of Settings (see Save JIRA's Configuration for more information):

You can overwrite JIRA default data by clicking on the checkbox button and then manually input your JIRA credentials. Then click OK:

If you overwrite only one field, Faraday will fill the others fields with the default data. E.g: if you overwrite Project Key, Faraday will fill URL field with the information you have saved in Settings.

With Basic auth.

Click Done.

You should see the word JIRA appearing on the issuetracker column at your vuln, you can click on it to see the issue that has been created on JIRA!

In Jira

Template The template is preloaded in description but you can use the fields described in our jinja2 context doc Link The template's name where you'll define the issue's description. You can call any attribute of the vulnerability object using Jinja2 syntax. E.g., if you want your issue in JIRA to have as description the target, the hostnames, and the severity of the vulnerability, the template would be as follows:

{# This is a Template for Faraday Jira Integration #}
{# Pre-Flight Adjustments #}
{% set issuetracker_config = 'jira' %}
{% set http_size_config = 4096 %}
{% if 'med' in vuln.severity %}
{% set corrected_severity = 'Medium' %}
{% else %}
{% set corrected_severity = vuln.severity %}
{% endif %}
{# Issue template structure should go under this comment #}
{% if 'VulnerabilityWeb' in vuln.type %}
# [{{ corrected_severity | capitalize}}] {{vuln.name}} - ({{vuln.path}})
{% else %}
# [{{ corrected_severity | capitalize}}] {{vuln.name}}
{% endif %}
## Description
{{ vuln.desc }}
#### This issue has been rated as: `{{ corrected_severity | capitalize }}`
Affected Asset: {{vuln.target}}
{%  if vuln.website %}
Affected URL: {{ vuln.website }}{{ vuln.path }}
{% endif %}
{% if vuln.hostnames %}
#### Hostnames
{% for hostname in vuln.hostnames %}
- {{hostname}}
{% endfor %}
{% endif %}
## Recommendations
{{ vuln.resolution }}
{%for ref in vuln.refs%}
- {{ref}}
{%endfor%}
{%if vuln.easeofresolution%}
#### Estimated ease of resolution
{{ vuln.easeofresolution | capitalize }}
{%endif%}
### Technical Details
{%if vuln.data%}
#### Proof of Concept
{{vuln.data}}
{%endif%}
{%if vuln.request%}
#### Request

{{vuln.request|truncate(http_size_config, False, '...', 0) }}

{%endif%}
{% if vuln.response %}
#### Response

{{ vuln.response|truncate(http_size_config, False, '...', 0) }}

{%endif%}
## Issue [{{ vuln.id }}] {{vuln.name}} [{{vuln.status}}]
{# A vulnerability might be associated with more tha one issuetracker id #}
{% for key, value in vuln.issuetracker_json.items() %}
{% if issuetracker_config in key%}
This issue has already been reported in this platform:
- {{ key | capitalize}}
{% for line in value %}
- Issue: {{line.url}}
{% endfor %}
{% endif %}
source: created by {{vuln.owner or "faraday"}} using {{vuln.tool}} - {{vuln.external_id}} - {{vuln.date}}
{% endfor %}
{# end of file #}

You can also link an issue to an Epic. To do so, look after the custom field Epic Link of your instance and add it to your issue’s configuration (just as the example above). Once you add it, you need to type in the input field the issue keys of the epic.