How do I get the Beacon Alert details in a JSM incident Description field while using a webhook?

[Andre Simmons]

Hi!

I've setup a working connection to send Beacon alerts to a JSM project on our Sandbox, following the instructions here, https://intercom.help/atlassian-beacon/en/articles/7518713-send-beacon-alerts-to-jira.

I've also included the smartvalues to display the alert title in the issue summary and alert link in the issue description field. 

While this is working successfully, I'd prefer to have the Beacon alert details (Event root cause/Details/Actor) copied to the issue description field. See screenshot for an example of a manually created Beacon alert issue with the alert details in the description field.

When creating the JSM issue manually the beforementioned data is added automatically. This is not the case when using the webhook option. 

If I'm not mistaken a smartvalue should be added to the automation rule to accomplish this. Does anyone know what this smartvalue should be? If I'm not the right path, then please guide onto the correct one.

It would also be useful if the 'Investigation steps' and 'Remediation options' can be added to the JSM issue through automation.

Looking forward to your feedback.

Cheers,

Andre

[Tony Knopp]

Hey @Andre Simmons !

Beacon team member here, hopefully I can help! Shoot me an email at tknopp@atlassian.com at your leisure, I'd love to talk more about your use cases and how your organization integrates Beacon and Jira. We're always looking to find opportunity to make things easier!

Here what I would recommend!

1.) Find a secure location to setup a SIEM web-hook where you can inspect the payload being sent. Don't just use a webhook tester on the web since you may be sending sensitive information to it. I like something like this https://github.com/darklynx/request-baskets/

This will show you all the keys and values the payload has and you should be able to access.

2. Based on your screenshot, here are the corresponding smart fields that you should be able to pull in - We currently don't offer all the same fields in the Webhook payload as we do via the UI Jira ticket creation.

Details
Alert ID: {{webhookData.alertId}}

Product: {{webhookData.alert.product}}

Site: {{webhookData.alert.site}}

Event Start: {{webhookData.alert.created}}

Event End: N/A

Event Location: N/A

Actor

Name: {{webhookData.actor.name}}

Account URL: {{webhookData.actor.url}}

PositionCreated : N/A

Last Login: {{webhookData.actor.loginTime}}

Last Active {{webhookData.actor.lastActiveTime}}

I've also attached an example payload with all the keys/values we send currently, scrubbed out. Hopefully this helps so you can skip step 1! 

-Tony

[Andre Simmons]

Hi Tony,

Thanks for the feedback.

After a few updates, it's working as desired.

I'll contact you shortly via email.

Cheers,

Andre