Jira Integration with Splunk SIEM

[Farhan Shaikh]

Task:

We are attempting to integrate Jira Cloud authentication event logs into our on-premise Splunk instance using heavy forwarders.

Blockers:

During my search for technical documentation, I found an article published in March 2020 that explicitly states Jira Cloud logs are not available for integration with Splunk, as they are maintained and monitored by Jira and hosted online. This poses a significant challenge for our security team, as integrating Jira authentication log events into our SIEM platform is crucial for compliance. The specific blockers we are facing are:

1. Lack of official documentation on Jira.
2. Absence of an official Splunk Add-on available on the Atlassian Marketplace.

Available Solution:

We need to identify a solution or an official workaround to integrate these logs into our SIEM portal, are there any options to do this?

[Vronik]

Hi

Have you seen this information, it may help you?

https://support.atlassian.com/jira-service-management-cloud/docs/integrate-with-splunk/

https://community.splunk.com/t5/Other-Usage/Recommended-way-for-integration-from-Splunk-to-Jira/m-p/675719

https://splunkbase.splunk.com/app/6211

https://community.atlassian.com/forums/Jira-questions/How-to-integrate-with-Splunk/qaq-p/2591482

https://marketplace.atlassian.com/apps/1224409/victorops-for-jira-cloud?hosting=cloud&tab=overview

Regards