If native Jira does not record attachment-download events in the way you need, I would first define the audit requirement before choosing a workaround.
Useful questions to write down:
- Do you need evidence that a file was downloaded, or only evidence that the attachment existed and was accessible?
- Is the requirement for security investigation, customer audit, or internal review?
- Do you need user-level attribution, timestamp, IP/device context, or just a reportable event?
- How long does the evidence need to be retained?
- Who needs to trust the evidence later: an internal admin, a customer, security, or an auditor?
Those answers matter because an app, an export, and a process record solve different audit problems.
The risky path is collecting logs that feel like evidence but do not answer the audit question. If the reviewer needs user-level proof and the system only gives access-state proof, the gap shows up too late.
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.