Jira Integration with Splunk SIEM

[Farhan Shaikh]

Task:

We are attempting to integrate Jira Cloud authentication event logs into our on-premise Splunk instance using heavy forwarders.

Blockers:

During my search for technical documentation, I found an article published in March 2020 that explicitly states Jira Cloud logs are not available for integration with Splunk, as they are maintained and monitored by Jira and hosted online. This poses a significant challenge for our security team, as integrating Jira authentication log events into our SIEM platform is crucial for compliance. The specific blockers we are facing are:

1. Lack of official documentation on Jira.
2. Absence of an official Splunk Add-on available on the Atlassian Marketplace.

Available Solution:

We need to identify a solution or an official workaround to integrate these logs into our SIEM portal, are there any options to do this?

[Rik de Valk _Brainboss_]

HI @Farhan Shaikh , 

With Atlassian Guard Premium you get the possibility to send audit log events to your SIEM solution. 

This can be Organisation Admin events but also App Log events. 

You can read more about that here: https://support.atlassian.com/security-and-access-policies/docs/learn-more-about-audit-log-webhooks/ 

And for what logs are available here: https://support.atlassian.com/security-and-access-policies/docs/accessing-audit-log-activities/

Have a nice day. 

Rik 

[Vronik]

Hi

Have you seen this information, it may help you?

https://support.atlassian.com/jira-service-management-cloud/docs/integrate-with-splunk/

https://community.splunk.com/t5/Other-Usage/Recommended-way-for-integration-from-Splunk-to-Jira/m-p/675719

https://splunkbase.splunk.com/app/6211

https://community.atlassian.com/forums/Jira-questions/How-to-integrate-with-Splunk/qaq-p/2591482

https://marketplace.atlassian.com/apps/1224409/victorops-for-jira-cloud?hosting=cloud&tab=overview

Regards