Comment posted under my account, but I did not post it

[Luyang Zhang]

Today, a coworker asked me why I posted a comment under her Jira ticket which is totally unrelated to my daily work. However, I did not create or submit that comment myself.

I checked a few things but still couldn't figure out where it came from, please help.

1. My PC and my phone were all under my hands at that moment, and they were the only two available devices have my account access.
2. According to the Atlassian audit log, no user action was executed, under my account at that moment.
3. According to the ticket, the automation section is empty and showing "There are no recent rule runs for this issue."
4. The format of the comment posted is quite AI to me. However, no record on using AI or Rovo under my account at that moment. 
5. No Clawbot installed on my PC or phone.

I attached the audit log below, while the comment was posted on Mar 11 at 10:31 EDT.

[Trudy Claspill]

 Hello @Luyang Zhang 

The Audit Log you are referencing in your screen images does not record actions taken at the issue level. That log is for recording Jira application setting level actions, like change configuration elements.

Besides Automation Rules there are a number of other ways that comments can be added to an issue automatically, such as through workflow Post Functions or actions taken through a script.

Is the comment referencing an issue that is linked to the issue where the comment appeared?

Did you execute an action on the issue referenced in the comment?

If the issue referenced in the comment was linked to the issue commented at the time, there may be something related to the transitioning of that referenced issue that causes comments to be added to the linked issues.

[Luyang Zhang]

Hi Trudy, thanks for your reply.

Did you execute an action on the issue referenced in the comment?

• Yes, as the mystery comment shows, the referenced issue was marked as done at exactly that moment.
• However, between these two issues, they are not parent-child, not linked by any linked type, no associated field, besides they are under the same JSM project with same request type, reporter and assignee. 
• I checked the workflow and the issue history and no new found. There was no workflow transition for over a week on this issue.
• No automation was executed at that time as I posted below. 
  • Ref: https://community.atlassian.com/forums/Jira-questions/Comment-posted-under-my-account-but-I-did-not-post-it/qaa-p/3205263#M1172077

[Trudy Claspill]

Let me see if I understand the flow of events:

1. You transitioned AAA-1 to Done
2. In AAA-2 within moments a comment appears with a link to AAA-1 and a message that it was transitioned to Done, with you as the author of the comment.

You said there is currently no link between AAA-1 and AAA-2. Did you check the issue history of both to see if any such link existed at the time of the comment, which was subsequently removed?

Have you looked at the workflow for that issue type and examined the transition to Done to see if it includes a post function to create a comment?

Do you have a third party app that provides Listener functionality, to listen for events and execute actions? ScriptRunner is one such app. JMWE is another. If so, is one set up to listen for transition events in this project and take some action, like adding a comment.

There is also the native System Webhook functionality that can listen for events and fire REST API calls in response. Does one exist that would react to transitions in this project?

[Luyang Zhang]

The flow of event is:

1. Coworker X (not me) transitioned AAA-1 to Done
2. In AAA-2 within moments a comment appears with a link to AAA-1 and a message that it was transitioned to Done, with me as the author of the comment.

I just checked the history of those two issues, and no history of linking found. 

The only action executed by me on those two issues was I updated their request type.

I checked the workflow and there is no post function on any path.

For third party app, we only have Time Tracker and Zephry installed on our instance and I don't think they provides Listener functionality. 

I checked the API token log, indeed, there were several API got called that day (don't know the specific time and frequency). However, none of them belongs to me and none of those user has admin permission, so they should face a 403 even they tried to post with my account.

[Trudy Claspill]

I am running out of ideas. :-(

Can you check System Webhooks to see if there are any webhooks that may have been triggered?

<yourBaseUrl>/plugins/servlet/webhooks

[Luyang Zhang]

I checked system webhooks, the listed 3 webhooks are all restricted with JQL so should not be the cause. The only suspicious thing is it shows 4 webhooks found but only list 3 below. 

[Trudy Claspill]

I have exhausted all my ideas.

Have you seen the problem recur or was it a one-off?

To get additional help at this point I recommend opening a support case directly with Atlassian.

[Matt Doar (Adaptavist)]

I'm out of ideas too. Atlassian Support should enjoy reading this thread and all the ideas we've had. I'll be interested to hear if you work out what caused this

[Matt Doar (Adaptavist)]

Did you mean 9:31 EDT?

Any chance there is another user with the same name?

I would suspect an automation being run as you, somewhere else?

[Luyang Zhang]

Hi Matt, 

• I was referring to 10:31 EDT which is the comment in the first screenshot above.
• I am the org admin and there is no user in my org with the same name and same profile picture.
• I checked the automation history under the ticket and global automation log, nothing related happened at that moment.
  • 

[John Funk]

You need to click the Refresh button under the Automation section to see the rules that have run. 

[Luyang Zhang]

Hi John, I have click that button several times but still shows nothing.

[John Funk]

Hmmm, do items show up on other work items if you click it? 

[John Funk]

Updates can also happen as a result of events firing on the workflow. 

[Luyang Zhang]

Hmmm, do items show up on other work items if you click it? 

• Yes, the automation log section is fully functional.

Updates can also happen as a result of events firing on the workflow. 

• I checked the workflow and there is no post function on any path.
•