Skip to main content
The Jira integration lets you create tickets from your security findings and hand them off to development teams for remediation. You can send findings manually from the findings list, or set up a notification rule that sends them automatically after each scan.
Available on every paid plan.

​
Setting up Jira

1

Access integration settings

Go to Settings > Integrations > Jira.
2

Enter Jira URL

Add your Jira instance URL (e.g., https://yourcompany.atlassian.net).
3

Add credentials

Enter your Jira email and API token.
4

Specify project

Enter the project key where tickets will be created.

​
Getting your API token

For Jira Cloud:
  1. Go to Atlassian Account Settings
  2. Click Create API token
  3. Name the token (e.g., “Pentest-Tools.com”)
  4. Copy the token and save it securely
API tokens cannot be viewed again after creation. Store your token securely.

​
Creating Jira tickets

Once configured, you can send findings to Jira from the findings list in two ways: Single finding: open a finding and click Send to Jira, or use the row action menu. Multiple findings at once: select findings from the list, then click Send to Jira in the toolbar. One ticket is created per finding. When sending in bulk, you can filter which findings to include:
  • Include or exclude false positives
  • Include or exclude informational findings
  • Include or exclude unverified findings
  • Include or exclude duplicates
To skip this step after every scan, send findings to Jira automatically with a notification rule.

​
Ticket contents

Each Jira ticket includes:

​
Sending findings automatically

You can add Jira as a destination in a notification rule. When a scan finishes and its findings match the rule, a Jira ticket is created for each matching finding in the project set in your Jira integration. This works for all scans in the workspace, whether you start them manually, schedule them, or run them through the API.
1

Set up the Jira integration

Follow the steps in Setting up Jira. The Send to Jira option appears in notifications only after the integration is configured.
2

Create a notification

Click Notifications in the sidebar, click Add, and select the Vulnerability trigger.
3

Set conditions

Choose which findings go to Jira, for example Risk level is at least High, or only findings with the Confirmed tag.
4

Turn on Send to Jira

Under Notification actions, turn on Send to Jira. The project key from your Jira integration is shown under the toggle.
5

Save

Click Save. Matching findings are sent to Jira after every scan from then on.
Jira works only with the Vulnerability trigger and can’t be combined with the Diff condition. If the rule uses a different trigger or a Diff condition, the Send to Jira toggle is disabled.

​
Which findings are sent

  • Each matching finding gets its own ticket, with the same contents as a manual send.
  • Findings marked as False Positive, Accepted, or Ignored are never sent.
  • Findings already sent to the same Jira project, manually or by a notification, are skipped. This includes duplicates of the same finding found in later scans, so recurring scans don’t flood your board with repeat tickets.
Manual sends from the findings list don’t check for existing tickets. Sending a finding manually always creates a new ticket. Changes made in Jira aren’t synced back either: if you delete a ticket in Jira, the finding still counts as sent and won’t be sent again automatically.

​
When sending fails

If your Jira instance can’t be reached, or Jira rejects the request because of invalid credentials, missing permissions, or a project key that doesn’t exist, sending stops and you get an email with the error. Check your settings in Settings > Integrations > Jira, then run the scan again.

​
Tracking tickets

Once a finding is sent to Jira:
  • The finding shows a link to the Jira ticket
  • You can track which findings have associated tickets
  • Click the link to jump directly to Jira

​
Best practices

Use Jira labels and components to organize security tickets separately from regular development work.

​
Prioritizing tickets

  • Set up a notification rule that sends critical and high findings to Jira automatically
  • Batch medium and low findings for regular triage
  • Use finding severity to set Jira priority

​
Team workflow

  • Assign tickets to appropriate team members in Jira
  • Use Jira automation for routing and notifications
  • Link related tickets to track remediation across issues

​
Configuration reference

​
Troubleshooting

  • Verify your Jira URL is correct
  • Check that the API token is valid
  • Ensure the project key exists
  • Verify your account has permission to create issues
  • Check that the notification rule is enabled
  • Make sure the rule uses the Vulnerability trigger without a Diff condition
  • Check whether the finding was already sent to the same Jira project (open the finding to see its Jira link)
  • Findings marked as False Positive, Accepted, or Ignored are not sent
  • Look for an error email about Jira and verify your integration settings
  • Check your Jira account permissions
  • Verify you can create issues in the target project
  • Ensure the API token hasn’t been revoked
  • Verify the Jira URL format
  • Check that your Jira instance is accessible
  • Try regenerating the API token