Jira Integration

Overview

The Jira integration connects your Fencer organization to Jira Cloud, allowing you to create Jira issues directly from vulnerabilities, detections, secrets, and vulnerability groups. It also syncs status back from Jira — when a Jira issue transitions to a “Done” or “Cancelled” state, the linked Fencer items update automatically. Fencer does not change a Jira issue’s status when a scan resolves the vulnerability.

This integration helps security and engineering teams manage remediation workflows without switching between tools.

Prerequisites

A Fencer account with the Administrator role in your organization.
An active Fencer subscription.
A Jira Cloud instance (e.g., https://yourcompany.atlassian.net).
Admin access to your Jira site, or permission to install OAuth applications.

How it works

Fencer connects to Jira Cloud via OAuth 2.0. During the OAuth flow, Fencer requests read and write access to Jira issues (read:jira-work, write:jira-work), user information (read:jira-user), and webhook management (manage:jira-webhook), plus offline_access for refresh tokens. Once authorized, Fencer stores an encrypted access token and refresh token that are automatically renewed. Connecting also syncs your Jira users as identities when your plan includes identity management.

After connecting, you configure state mappings for one or more Jira projects. Each state mapping defines which Jira statuses correspond to the four lifecycle stages: To Do, In Progress, Done, and Cancelled. When you save the configuration, Fencer registers a webhook on the mapped projects so that issue status changes in Jira are relayed back to Fencer in real time.

Usage / Configuration

Connecting Jira

Navigate to Admin > Integrations in your organization.
Click the Jira card, then click Continue.
Click Connect Jira. You are redirected to Atlassian’s authorization page; review the permissions and click Accept.
After authorization, Fencer retrieves the accessible Jira site and redirects you to the Jira Configuration page.

Configuring state mappings

After connecting, you are taken to the Jira Configuration page. You can return to it later with Edit on your Jira connection in Admin > Integrations. Here you map Jira project statuses to Fencer lifecycle stages.

Select a Project from the dropdown. Fencer fetches the project’s available statuses automatically.
For each status category, choose the Jira status that corresponds to:
- Todo Status — the initial status for new issues.
- In Progress Status — work has started.
- Done Status — the issue is resolved. When a linked Jira issue reaches this status, Fencer moves open vulnerabilities and open vulnerability groups to Ready for verification, and new or under-investigation detections to True Positive.
- Cancelled Status — the issue was discarded. Linked vulnerabilities and vulnerability groups are ignored with the reason Will Not Fix, and new or under-investigation detections are marked False Positive.
Click Add Project Mapping to map additional projects if needed.
Click Save to persist your mappings. Fencer registers a webhook for the mapped projects to relay status changes to Fencer.

Creating a Jira issue from Fencer

You can create Jira issues from several places in Fencer:

Open a vulnerability, detection, or secret detail page.
Click Jira (for a vulnerability, in the Tracking row). The Track in Jira dialog opens on its Create tab.
Optionally edit the Summary (auto-generated from the item if left blank), then select the Project, Issue type, and Assignee. The description is filled in with details from the Fencer item.
Click Create issue. The new Jira issue key is automatically linked to the Fencer item.

Fencer sets the Jira priority from the item’s severity (for several items in one issue, the highest severity) as follows:

Fencer Severity	Jira Priority
Critical	Highest
High	High
Medium	Medium
Low	Low
Info	Lowest

Linking an existing Jira issue

On a vulnerability, detection, or secret detail page, click Jira and open the Link tab.
Search for the issue by key or summary text under Issue.
Optionally turn on Update issue description, then click Link issue.

To unlink, open the menu next to the linked issue key on the same detail page and click Unlink. You can also choose Update issue description or Close issue as you unlink.

Bulk operations

You can create, link, or unlink Jira issues in bulk from the vulnerabilities (including grouped views), detections, and secrets lists. Select multiple items, then choose Jira from the bulk actions bar. On the Create tab, choose Single for one issue covering every selected item or One for each for an issue per item, then click Create issue or Create issues. The Link and Unlink tabs work as on a detail page.

Opening issues automatically

An automation opens Jira issues for you when a rule matches. You need permission to edit automations (organization admins have it). For the full reference, see Automations.

Go to Settings > Automations and click New automation. Pick a starter such as Critical and high vulnerabilities to an issue, Leaked secrets to an issue, or SLA breaches to an issue, or click Start from scratch.
Under When this happens, choose the trigger and add conditions to narrow it. Jira tickets can be opened from New vulnerability detected, Vulnerability status changed, Vulnerability SLA alert, Vulnerability deferral overdue, and Security detection; the other triggers in the list only offer Notify.
Under What to do, choose Create a ticket in Jira and fill in the Project (required), the Issue type (Bug by default), and optionally the Assignee.
Under How to file, choose Grouped (one issue per run, listing every matching vulnerability) or Per vulnerability (one issue each).
Under More settings, Skip vulnerabilities that already have a Jira issue (on by default) prevents duplicates, and Max vulnerabilities per run (25 by default, at most 100) caps each run. Vulnerabilities above the cap are skipped and listed in the run log.
Optionally choose Assign to the vulnerability owner; the Assignee then becomes the Fallback assignee for owners Fencer cannot match.
Click Preview to see the issues the automation would open, then click Save rule. Use Runs to see what each run filed.

Each issue ends with a footer naming the automation that opened it. If Jira is disconnected, the rule still runs but its ticket action fails with “Jira is disconnected. Reconnect Jira to resume delivery.”, and the rule shows Needs attention in the list until you reconnect Jira.

Examples

Scenario: Tracking a critical vulnerability in Jira

A code scan discovers a critical SQL injection vulnerability.
From the vulnerability detail page, you click Jira, choose the “SEC” project and an assignee on your backend team, and click Create issue.
Fencer creates SEC-42 in Jira with the vulnerability description, severity, code location, and remediation guidance pre-filled.
When the engineer resolves SEC-42 in Jira (moving it to the “Done” status), Fencer automatically transitions the vulnerability to Ready for verification.

Troubleshooting

“No Jira sites accessible with this account” — The Atlassian account used during OAuth does not have access to any Jira Cloud sites. Verify the account has the correct permissions in Atlassian admin.
Webhook events not syncing — Ensure the state mappings are saved after any project changes. Saving re-registers the webhook. Also confirm the Jira project key in the mapping matches the project where issues are being updated.
“Jira integration not configured” when creating issues — The Jira connection may have been disconnected or the OAuth tokens expired. Reconnect from Admin > Integrations.
Connection shows an Issue status — Fencer checks the connection when it loads your Jira projects. If the check fails, the connection is marked as broken. Try reconnecting the integration to refresh the OAuth tokens.