Jira Integration with DefectDojo

Jira Integration with DefectDojo

Jira is Atlassian's issue and project tracking software, used by many engineering organizations to plan and track development work. It is available as Jira Cloud and as self-managed Jira Data Center (and the older Server edition). Unlike a scanner integration, the DefectDojo Jira integration works in the other direction: DefectDojo pushes Findings out to Jira as issues, keeps them updated, and can receive status changes and comments back. Jira Service Management is not supported.

Jira Integration with DefectDojo

Our developers live in Jira and our security findings live in DefectDojo. Asking engineers to check a second tool never worked, so we push the Findings that need fixing into the Jira projects where the work is planned. DefectDojo stays the place where we deduplicate, triage, and measure SLAs. Jira is where the fix gets scheduled. When a developer closes the issue, the Finding closes too, and a comment on either side shows up on the other.

Why Jira Matters

Security findings only get fixed when they become part of someone's planned work.

• Jira is where sprint planning, prioritization, and ownership already happen for most development teams.
• Developers can work a security issue without a DefectDojo account, because the issue carries the context they need.
• Status changes in Jira can drive status in DefectDojo, so metrics reflect what engineering actually did.
• Without an integration, someone copies findings into tickets by hand, and the two systems drift apart within a week.

Advantages of This Integration

What we gained by connecting DefectDojo to Jira:

• Only triaged work reaches developers. Findings are deduplicated and triaged in DefectDojo first, so Jira gets one issue per real problem instead of one per scanner hit.
• Automatic or selective pushing. Push individual Findings, push Finding Groups as a single issue, or push every eligible Finding in an Asset automatically.
• Status sync. Closing an issue in Jira can mitigate the Finding, reopening it reactivates the Finding, and specific Jira resolutions can mark a Finding as risk accepted or false positive.
• Conversation in both places. Notes on a Finding can appear as Jira comments, and Jira comments can come back as notes.
• SLA pressure where it counts. DefectDojo can add a comment to the Jira issue when a Finding breaches its SLA, and again when a risk acceptance expires.

How This Integration Works

There are two implementations, and which one you use depends on your edition.

Community Edition: Jira integration. Community Edition includes a Jira integration configured per Asset or Engagement. DefectDojo Pro also still supports this integration, where it is labeled as the legacy Jira integration.

1. Enable it. In Configuration, System Settings, check Enable JIRA integration and generate a Jira webhook secret. Until this is on, the other Jira settings are hidden and pushes, including API requests with push_to_jira, are ignored.
2. Connect a Jira instance. Under Configuration, JIRA, add a configuration with the Express or Standard form. Jira Cloud requires a username with an API token; Data Center accepts username and password. Choose a default issue type and an issue template (jira_full or jira_limited), and optionally map Jira resolutions to Risk Accepted and False Positive.
3. Link Assets or Engagements. On the Edit Asset form, set the Jira project key, issue template, components, labels, default assignee, and options such as Push All Issues, Push Notes, Engagement Epic Mapping, and SLA notification comments. Engagements inherit these settings unless overridden.
4. Turn on bidirectional sync (optional). Check Enable JIRA web hook, then create a Jira webhook pointing to https://YOUR_DOJO_DOMAIN/jira/webhook/YOUR_SECRET with comment created and issue updated events enabled. Treat that URL as a credential. Where system webhooks are restricted, Jira Automation's Send web request action can post to the same endpoint.

You can push Findings from the Finding page, in bulk, automatically through Push All Issues (Active and Verified Findings only), or at import time:

curl "https://YOUR_INSTANCE/api/v2/import-scan/" \
  -H "Authorization: Token $DD_API_TOKEN" \
  -F "scan_type=Trivy Scan" \
  -F "file=@trivy-report.json" \
  -F "product_name=payments-api" \
  -F "engagement_name=CI" \
  -F "verified=true" \
  -F "push_to_jira=true"

DefectDojo Pro: Jira Downstream Connector. DefectDojo Pro adds a Jira Downstream Connector, which is on for every Pro instance and is the recommended path for new setups. It supports Jira Cloud (API token, OAuth 2.0, or service account token) and Data Center or Server (personal access token or username and password). Configuration has three layers: an Instance with credentials, an Issue Tracker Mapping with the project key, issue type, and severity and status mappings, and Issue Tracker Assignments that attach Assets or Engagements to a mapping with one of four push behaviors, from explicit pushes only to automatic create and update. Custom fields can be filled from Finding, Test, Engagement, or Asset attributes or static values, at creation, on every update, or on a specific transition. Ticket Templates let you override issue titles and bodies. Two-way sync is enabled per connection and uses a Triage Engine webhook receiver. Pro also includes a built-in migration that moves classic Jira configuration and existing ticket links onto the connector without creating duplicate issues.

Data Granularity: What Gets Sent

Use Cases

Developer-facing backlog: The AppSec team triages each import in DefectDojo, then pushes only verified High and Critical Findings to the development team's Jira project. Developers fix them as normal tickets and never need DefectDojo access, while the security team tracks SLAs centrally.

Security triage board: A security team pushes every Finding to its own Jira project with bidirectional sync enabled, splitting validation work across analysts. Closing or reopening issues there updates DefectDojo automatically.

Grouped remediation: When one library upgrade fixes forty CVEs, importing with a group-by option and pushing the Finding Group creates one Jira issue for the upgrade instead of forty separate tickets.

Moving to DefectDojo Pro: A team that started on the Community Edition integration upgrades to Pro, runs the classic Jira migration, and keeps its existing tickets linked while gaining templated tickets, dynamic custom fields, and OAuth authentication.

Operational Tips

• Push All Issues only pushes Findings that are both Active and Verified. If nothing reaches Jira, check the verified flag on your imports first.
• Jira resolution mappings depend on the Jira workflow actually setting a resolution. Add a Set issue resolution post-function to the closing transition, or Findings will only be marked mitigated.
• Use the Jira minimum severity setting or targeted pushes to keep Low and Info Findings out of developer backlogs.
• If your Jira project requires custom fields, configure them before the first push. In Community Edition they can only carry default values, so plan for someone to update them in Jira.
• On DefectDojo Pro, edit the status mapping defaults (To Do, Done) to your workflow's real status names, and note that deleting a Finding force-closes its Jira issue rather than deleting it.
• After migrating to the Pro connector, leave the classic webhook in place until you turn on two-way sync, since the migration does not enable it for you.
• A Jira instance with issues already created can't be fully removed from DefectDojo. Disable the connection on the Asset instead.