Send Security Lab findings to Jira or ServiceNow

Have Zonitix open a ticket in your own ticketing system for each serious security finding, and close it when a re-scan shows the problem is fixed.

For: IT administratorPlan: Advanced

Before you start

This guide assumes you administer Jira or ServiceNow for your company, or can get an API token or a service account from the person who does; if not, do this together with that person.
Security Lab in use, with at least one scan run. See Run a Security Lab scan.
A role that lets you manage Security Lab scopes or manage compliance, to save the setting.
A role that shows Access GovernanceIdentity Hooks, to connect Jira or ServiceNow.
For Jira: your site address, an admin’s email and an API token, and the key of the project the issues should go to (for example SEC). That project must have the issue type Bug: Zonitix files every finding as a Bug. For ServiceNow: your instance address and the username and password of an account Zonitix may use.

Connect the ticketing system

Step 1: Add Jira or ServiceNow as a hook
Go to Access GovernanceIdentity Hooks, click “NEW INTEGRATION” and pick “Jira” or “ServiceNow”. Click “Configure” on the new card.
Jira asks for “Site” (such as company.atlassian.net), “Admin email” and “API token”. ServiceNow asks for “Instance URL”, “Username” and “Password”. Work through the steps and finish when the checks pass. The full walk-through is in Connect an app.

Turn on automatic tickets

Step 2: Open Ticketing
Go to Security & ComplianceSecurity Lab. At the top of the page, click “Configure” and choose “Ticketing”. A window titled “Auto-file findings” opens.
Step 3: Choose where tickets go
Under “Ticketing provider”, pick the hook you connected. For Jira, a second field appears: “Jira project key (e.g. SEC)”. It is required; without it no issue can be created.
Click “Save”. The window shows “Saved.”
Step 4: To stop, choose None
Open the same window, set “Ticketing provider” to “None (disabled)” and save. No new tickets are opened. Tickets already open in Jira or ServiceNow stay as they are.

What happens after that

Step 5: New serious findings get a ticket
After each scan, Zonitix opens one ticket for each new finding rated Critical or High, and for a finding that had been fixed and has come back. Scanning again does not create a second ticket for the same finding.
The ticket is a Jira issue or a ServiceNow incident. Its title starts with [Zonitix Security] and its text gives the severity, what was tested and the suggested fix.
Step 6: Fixed findings close their ticket
When a re-scan confirms a finding is fixed, Zonitix closes the Jira issue, or marks the ServiceNow incident Resolved, with a note saying so. If the finding returns later, Zonitix reopens it.
In Jira, this only works if the issue can move straight to a status such as Done, Closed or Resolved. If your Jira workflow has no such move from where the issue is, Zonitix leaves the issue alone.

Tickets are an extra. If Jira or ServiceNow cannot be reached, the scan still finishes and the finding is still recorded in Zonitix; only the ticket is missing. You can always type a ticket number yourself in the finding’s “ticket ref” box.

What you should see

After the next scan with a new Critical or High finding, the finding shows a small label with the ticket number, such as SEC-12. Hovering over it shows the ticket’s state.

The same ticket appears in the Jira project or the ServiceNow incident list.

If something goes wrong

"No Jira or ServiceNow integration is connected. Connect one under Integrations first.": There is no Jira or ServiceNow hook yet. Add one under Access Governance, Identity Hooks (step 1), then reopen the Ticketing window.
"Enter the Jira project key — without it no issue can be filed.": Type the short key of the Jira project, the letters that come before the number in an issue such as SEC-12. The Save button stays off until you do.
The provider is listed with "— inactive" after its name: The hook is paused or has not passed its checks. Open it on Identity Hooks and validate it. No tickets are opened or closed through an inactive hook.
A Critical finding has no ticket: Tickets are only opened for findings that are new since ticketing was switched on, or that have come back. Check that the Jira project key is right, that the project has the issue type Bug (Zonitix files every finding as a Bug, and a project without that type gets no issue), and that the account behind the token may create issues in that project. If it still fails, type the reference by hand and contact Zonitix support.
"Could not load the current ticketing settings, so nothing can be saved yet.": Click Retry. Save is switched off until the current settings have loaded, so that an empty form cannot overwrite a working setup.