Jira Install

Updated 1 week ago by Elvis Hovor

This document explains how to install and configure the TruSTAR integration for Jira Cloud and Jira Enterprise.

Time to Install: 30 minutes

How TruSTAR Works with Jira

With the TruSTAR plug-in, you can automatically or manually send Jira issues to TruSTAR for enrichment. Any information, such as deep links, priority indicators, or correlated observables, found in TruSTAR is loaded back into the Jira issue for deeper investigation. 

To keep information in sync between Jira and TruSTAR, you can configure the TruSTAR plug-in to automatically submit new Jira issues to create TruSTAR reports, update both Jira issues and TruSTAR reports, and delete TruSTAR reports when you delete a Jira issue.

Terms

  • Station: The TruSTAR threat intelligence management SAAS platform. 
  • Station User: An individual human that uses the Station platform.
  • Station User Account: An account on the Station platform assigned to one user.
  • Enclaves: Data repositories in the Station platform. Each data source imported by Station resides in its own enclave. For more information on Enclaves, see "What is an enclave."
  • Observable: Artifacts found on a network or operating system that indicate a likely intrusion. Typical observables are virus signatures, IP addresses, MD5 hashes of malware files, URLs, or domain names. 
  • IOC: Indicator of Compromise. Another term for Observables.

Components

TruSTAR offers two plug-ins for Jira, depending on the type of Jira installation you have:

  • Jira Cloud
  • Jira Server (Enterprise)

Installing the Jira Cloud Plug-In

Requirements

To install the plug-in for Jira Cloud, you need:

Installation Procedure

  1. Connect to the Atlassian Marketplace website from the Atlassian administration console.
  2. Navigate to Jira Settings, then Add-ons-> Find New Add-Ons.
  3. Enter TruSTAR in the search box. 
  4. Download the plug-in and install it.

Accessing the Configuration Settings

  • Go to Jira Settings, then Add-Ons, then Manage Add-Ons.
  • Select TruSTAR Jira Cloud, then click Configure

Installing the Jira Server Plug-In

Requirements

To install the plug-in for Jira Server, you need:

Installation Procedure

  1. Connect to the Atlassian Marketplace website from the Atlassian administration console.
  2. Select the Find New Add-ons link from the Settings drop-down menu.
  3. Enter TruSTAR in the Search the Marketplace box.
  4. Click Install for TruSTAR in the search results.

Accessing the Configuration Settings

  • Select TruSTAR Configuration in the Manage Add-ons section.

Configuring the App

After you install the TruStar plug-in, you are ready to configure it for use.

The Parameters page is where you supply the details that the TruSTAR plug-in requires in order to work with TruSTAR Station and your TruSTAR enclaves.

You must have Administrator permissions to configure the Jira plug-in. 

Parameter

Required

Description

TruSTAR URL

Yes

The TruSTAR station URL from which data is collected by executing API calls. Set this parameter to https://station.trustar.co 

API Key

Yes

Used to make API calls. You can find this Key in the TruSTAR Station web interface under Settings-> API. How to find your API Key

API Secret

Yes

Used when making API calls. Available under Settings-> API on TruSTAR Station. How to find your API Secret Key

Enclave IDs 

Yes

The TruSTAR Enclave IDs where your submitted Jira issues are created as TruSTAR reports.To use multiple enclaves, separate each enclave ID with a comma and no spaces:

Retrieving your Enclave IDs

Fields

No

Custom fields to be included in the TruSTAR report. By default, status and key are included.To specify multiple fields, separate fields with commas. For example, id,summary,status,comments

Excluded Projects

No

Issues with project keys listed here will not be submitted to TruSTAR. Leave this field blank to submit all Jira issues to TruSTAR. 

To specify multiple projects, separate the project keys with commas. 

Jira Final Status

No

If you supply a value here, then when a Jira issue is changed to this status, that issue is synced one final time with the related TruSTAR report. For example, if you used “Closed” as the final status for your JIRA issues, then supplying the value “Closed” here will ensure the issue is synced one last time with TruSTAR. 

Auto Submission

No

Automatically sends Jira Issues to TruSTAR.Note: If the Jira issues is in an Excluded Project, it will not be submitted to TruSTAR.

Proxy Setup

No

If you use a proxy, you must specify the following information: 

  • IP/Hostname (do not include http/https)
  • Port

Best Practices

To optimize using the TruSTAR integration with Jira, here are some suggestions. 

  • Create an email account specifically for your Jira integration (ex: soc_trustar_jira_integration@customercompany.com).
  • Create a TruSTAR Station account tied to that Jira integration email address. You will need access to that email account so you can open the account verification email TruSTAR Station will send to it.  Your JIra instance will use this Station account’s API credentials. 
  • Check that the IP addresses supporting traffic to Station are whitelisted in your firewall or proxy rules. The current list of IP addresses are listed near the bottom of this support page: https://support.trustar.co/article/n2h2ylhiqo-faq
  • Check your TruSTAR API limits.
  • Avoid importing from more enclaves than you need to as each one takes time to process.


How Did We Do?