Jira Security Linking Issues

[Peter Loh]

Is there a way for me to link two tickets created from a jira security rule together?

Basic workflow is, when a vuln is found, create one ticket for product team to work on, link the vuln to the ticket, create one ticket for my team to track the fix, and also link the vuln to the ticket.

I would like to link the product ticket to my teams ticket with link type "is fixed by". The Link issues component only allow two options: "Trigger issue" and "Most recently created issue".

[Peter Loh · Accepted solution]

Hey @Bill Sheboy

Just an update on my end. Seems like setting the variable to {{createdIssue.key}} isn't working. Logs are showing

Wanted to see if you may have any other ideas?

[Bill Sheboy]

Would you please show the complete audit log details and your full current rule image for context?

I suspect there may be a missing / incorrect branch.

[Peter Loh]

Hey Bill! Attached is the audit log detailed and current rule. I just redacted the ticket # and project.

Let me know if anything else is needed.

[Bill Sheboy]

Yup, there is a missing branch to most recently created issue above that Link Issue action. 

Please see some earlier post above for the full context:

https://community.atlassian.com/t5/Automation-questions/Re-Re-Jira-Security-Linking-Issues/qaq-p/2616822/comment-id/9491#M9491

[Peter Loh]

Ah apologies. I missed that. I went ahead and added the branch. Thanks again for the help, Bill! Let me know if this is set up correctly of if I did it wrong.

[Bill Sheboy]

That looks correct now.  Have you tried testing it yet?

[Peter Loh]

Not yet! I was going to wait for another vuln to come through and review the output.

[Peter Loh]

Hi @Bill Sheboy

Just an update! Finally got some alerts and looks like it worked. Thank you for the help!

[Bill Sheboy]

Awesome; I am glad to learn that helped!

[Bill Sheboy]

Hi @Peter Loh -- Welcome to the Atlassian Community!

I believe you may also enter a smart value (for the relevant issue key) directly in that rule action.  Have you tried doing that?

If that does not work, please post an image of your complete automation rule, images of any relevant actions / conditions / branches, an image of the audit log details showing the rule execution, and explain what is not working as expected.  Those will provide context for the community to offer ideas.  Thanks!

Kind regards,
Bill

[Peter Loh]

Thanks Bill! I have not tried using the smart value. How do I go about knowing what smart value to use? So basically link the story to the task.

[Bill Sheboy]

Looking at your rule image, you want to link the second created issue (a Story) to the first one (a Task).

In this case, you can try linking with "Most Recently Created Issue", as that will refer to the one above the action: the Task.

Please try that and let me know how it works for you.  Thanks!

FYI...to use a smart value for linking, you type (or paste in) the smart value, and it will appear below the field.  If you then select the value below the field it will be used.  This technique works for many rule actions which look like they only accept a dropdown list value.

[Peter Loh]

Appreciate the help Bill!

Would we place that step at the end like so?

As for smart value, how do we know the syntax for it? Like how would I know what the smart value is to reference the task? I would start typing "{{ but it isn't auto populating anything so unsure what values with reference what. I am most likely doing this wrong on my end.

[Bill Sheboy]

Oops...my bad: in rules, issues must be created before they can be linked.

Some adjustments to your rule are needed (shown in italics below), as the first issue's key must be saved for use later with the Create Variable action:

• trigger: when vulnerability found...
• action: create issue (for the Task)
• action: link vulnerability to issue (most recently created issue)
• action: create variable
  • name: varTaskKey
  • smart value: {{createdIssue.key}}
• action: create issue (for the Task)
• action: link vulnerability to issue (most recently created issue)
• branch: to most recently created issue
  • action: link issue to {{varTaskKey}}

Regarding know which smart values to use in rules, I start here with the documentation page: https://support.atlassian.com/cloud-automation/docs/jira-smart-values-issues/

It shows most of them, while others (unfortunately) must be learned from experimentation and calling the REST API with an example issue to see the correct name and structure:

Smart values are name, spacing, and case-sensitive.  And often the smart value does not match the displayed field name on the issue views.  The steps below help to identify the correct smart value (and custom field id) for a field.

• identify an issue which has your field(s)
• call a REST API function with a browser to search for your issue:

https://<yourinstanceurl>/rest/api/2/issue/<issuekey>?expand=names

• search on the page for your field, such as with CTRL-F
  • if you find the field, you will also find the smart value, custom field id, and structure / attributes it has
  • if you do not find the field, it may not be supported by automation rules

[Peter Loh]

This is super helpful! I just implemented the changes you recommended and appreciate the smart values insight. I'll wait for the rule to trigger to see if this works. Thank you again for the help Bill!