Atlassian

Use Atlassian data with Cortex XSIAM.

Secure configurations, monitor identity risks, and manage agent security across your Atlassian environment (including Rovo).

This connector includes the following capabilities and sub-capabilities (if applicable):

• Agent Security Scanning (Atlassian Rovo): This capability is available with any active Cortex Cloud Posture Security license.

• Identity Posture: Maintain visibility and control over Atlassian identities, including users, groups, roles, and policies. This capability is available with any active Cortex XSIAM, Cortex Cloud Posture Security, Cortex Cloud Runtime Security, or Cortex Data Security license.

• Security Posture: Detect, monitor and alert on settings of your SaaS application. This capability is available with any active Cortex XSIAM or Cortex Cloud Posture Security license.

  • saas-posture-config-remediation: Help remediate the misconfigured security settings of your SaaS application. This sub-capability is available with any active Cortex XSIAM or Cortex Cloud Posture Security license.

How to configure the Atlassian connector

Agent Security

To access Atlassian Rovo, Cortex XSIAM requires the following information, which you will specify during the connection process.

• Admin Email: The login email address of the Atlassian Org Admin who created the API token and API key.

• API Token: A token, generated by an Atlassian Org Admin, enables Cortex XSIAM to authenticate to the administrator account.

• API Key: A key, generated by an Atlassian Org Admin, that enables Cortex XSIAM to scan and update organization settings and user accounts. Cortex XSIAM uses this key to identify and manage the third-party plugins that users have connected to Jira or Confluence.

• Organization ID: A unique, automatically generated identifier for your Atlassian Cloud account, serving as the primary identifier for managing users, products, billing, and settings centrally within the Atlassian ecosystem. Unlike organization names, which are not unique, the Organization ID guarantees each organization has its own distinct identifier for use in the URL, API, and various integrations.

Perform the following procedures in the order that they appear below.

Task 1. Generate and copy an Administrator API Token

1. Log in to Atlassian using Org Admin credentials.

2. From the Atlassian account profile, navigate to the API tokens page for the account (select Security > Create and manage API tokens or go to id.atlassian.com/manage-profile/security/api-tokens).

3. Click Create API Token.

4. Specify a name and an expiry date for your API token and click Create.

5. Copy the generated API token. Do not continue to the next step unless you have copied it, as you must provide this token during the onboarding process.

Task 2. Generate and Copy an API Key and an Organization ID

1. Log in to the Atlassian Admin Portal (admin.atlassian.com) using Org Admin credentials.

2. If you administer more than one Atlassian organization, select the organization you want Cortex XSIAM to scan.

3. Select Organization settings > API keys.

4. Click Create API key.

5. In the Before you begin page, choose API key without scopes and click Next.

6. Specify a name and an expiry date for the key and click Next.

7. Review your API Key details and click Create API key.

8. Copy the Organization ID and the API key. Do not continue to the next step unless you have copied both, as you must provide this information during the onboarding process.

Task 3. Connect Atlassian Rovo to Cortex XSIAM

1. In Cortex XSIAM, navigate to Settings → Data Sources & Integrations.

2. Click + Add new.

3. In the Add Data Sources or Integrations page, search for Atlassian.

4. Under Recommended, hover over the new Atlassian integration and click Add Instance to launch the Atlassian wizard.

5. Under the Capabilities tab, Enter a Name for your application.

6. Select Security Posture under Default Capabilities.

7. Click Next.

8. Under Connections, provide Admin Email and Organization ID to authorize the connection. In addition, under Agent Security Scanning, provide the API Key and API Token to authenticate the application.

9. Under the Configuration tab, select a Sync Interval. Choose a meaningful Tag to distinguish between various applications in different environments.

10. A confirmation message shows that your Atlassian instance is successfully connected. Confirm the Summary details and click Save instance. Note that scan times vary based on the amount of data; it takes at least one hour to display data in the Cortex XSIAM AISPM Agent dashboard.

Security Posture

To access Atlassian, Cortex XSIAM requires the following information, which you specify during the connection process.

• API Token: A token, generated by an Atlassian Org Admin, that enables administrator account authentication.

• API Key: A key, generated by an Atlassian Org Admin, that scans and updates organization settings and user accounts. This key is used to identify and manage third-party plugins connected to Jira or Confluence.

• Admin Email: The login email address of the Atlassian Org Admin who created the API token and API key.

Note: Your Atlassian Administrator settings may vary based on whether you have the free, Standard, or Premium versions. For Cortex XSIAM to scan settings at the Jira and Confluence level, you must connect a Jira app and a Confluence app.

If you extended Jira and Confluence capabilities by installing third-party plugins, Cortex XSIAM can also detect the third-party plugins and their access level.

Perform the following procedures in the order that they appear below.

Task 1. Generate and copy an Administrator API Token

1. Log in to Atlassian using Org Admin credentials.

2. From the Atlassian account profile, navigate to the API tokens page. Select Security > Create and manage API tokens, or go directly to id.atlassian.com/manage-profile/security/api-tokens.

3. Click Create API Token. A dialog prompts you to specify a label for the API token.

4. Specify a label and click Create. Atlassian generates and displays your new API token.

5. Copy the API token and paste it into a text file. Do not continue to the next step unless you have copied the API token. You must provide this token to Cortex XSIAM during the data connection process.

Task 2. Generate and copy an API Key for your Atlassian organization

1. Log in to the Atlassian Admin Portal using Org Admin credentials. If you administer more than one Atlassian organization, select the organization you want Cortex XSIAM to scan for third-party plugins.

2. From the left navigation, select Organization settings > API keys.

3. On the API keys page, click Create API key.

4. On the Before you begin page, select API key without scopes and click Next. You must select the API key without the scopes option. Cortex XSIAM does not support scoped API keys.

5. In the Create an API key dialog, specify a name and an expiration date for the key and click Create. Atlassian generates and displays a new API key.

6. Copy the API key and paste it into a text file. Do not continue to the next step unless you have copied the API key. You must provide this key to Cortex XSIAM during the data connection process.

Task 3. Connect Atlassian to Cortex XSIAM

1. In Cortex XSIAM, navigate to Settings → Data Sources & Integrations.

2. Click + Add new.

3. In the Add Data Sources or Integrations page, search for Atlassian.

4. Under Recommended, hover over the new Atlassian integration and click Add Instance to launch the Atlassian wizard.

5. Under the Capabilities tab, Enter a Name for your application.

6. Select Security Posture under Default Capabilities.

7. Click Next.

8. Under the Connection tab, enter the login email address of the Atlassian administrator who created the API token, and the API key.

9. Under the Configuration tab, select a Sync Interval. Choose a meaningful Tag to distinguish between various applications in different environments.

10. A confirmation message shows that your Atlassian instance is successfully connected. Confirm the Summary details and click Save instance.