Skip to content

Update documentation for security ticketing integration #33621

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
FredMoster wants to merge 1 commit into
base: master
Choose a base branch
from
Draft

Update documentation for security ticketing integration #33621

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
77 changes: 56 additions & 21 deletions content/en/security/ticketing_integrations.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,16 @@
- name: Code Security
url: /security/code_security/
icon: security-code-security
- name: Cloud Security
url: /security/cloud_security_management/
icon: cloud-security-management
further_reading:
- link: "/api/latest/security-monitoring/#create-cases-for-security-findings"
tag: "API"
text: "Ticketing integration API"
- link: "/service_management/case_management/"
tag: "Documentation"
text: "Case Management"
---

{{< product-availability >}}
Expand All @@ -25,41 +35,49 @@

## Case management and security products

Case Management is supported for all security products that use signals:
Case Management is supported for all security products that use signals or findings:

- Code Security (in [Findings][5])
- Cloud Security (in [Findings][11])
- Cloud SIEM (in [Signals][4])
- Code Security (in [Vulnerabilities][5])
- App and API Protection (in [Signals][6])
- Workload Protection (in [Signals][7])
- App and API Protection (in [Signals][6] and [Findings][12])
- Workload Protection (in [Signals][7] and [Findings][13])
Comment on lines +40 to +44
Copy link
Contributor

@VivianeQian VivianeQian Dec 31, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The links in those bullet points lead to a 404


Open any signal or finding in these products or do a bulk selection of findings in the explorers, and use the **Create Ticket** button to create a case in Datadog.

Check notice on line 46 in content/en/security/ticketing_integrations.md

View workflow job for this annotation

GitHub Actions / vale

Datadog.sentencelength 

Suggestion: Try to keep your sentence length to 25 words or fewer.

Open any signal in these products and use the **Create Case** button to create a case in Datadog.

## Bidirectional ticket syncing with Jira

Bidirectional syncing enables you to update Jira tickets automatically when changes occur in Datadog, and update some Datadog information when changes occur in Jira.

### Supported products

Bidirectional syncing is supported for the following Code Security vulnerability categories:
Bidirectional syncing is supported for the following Code and Cloud Security finding categories:

- Libraries (SCA)
- Static Code (SAST)
- Runtime Code (IAST)
- Secret Scanning (SDS)
- Infrastructure as Code (IaC)
- Misconfigurations
- Identity Risks
- Host and Container Vulnerabilities
- App and API Protection
- Workload Protection
Comment on lines +65 to +66
Copy link
Contributor

@VivianeQian VivianeQian Dec 31, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's only true for their findings based explorers. Their signals explorers only offers non bi-synced CM tickets


### Single source of truth

Bidirectional syncing with Jira enables you to sync Jira tickets with Datadog cases, but Datadog is the single source of truth for issue resolution.
Bidirectional syncing with Jira enables you to sync Jira tickets with Datadog cases, but Datadog is the single source of truth for issue detection and resolution.

Check notice on line 70 in content/en/security/ticketing_integrations.md

View workflow job for this annotation

GitHub Actions / vale

Datadog.sentencelength 

Suggestion: Try to keep your sentence length to 25 words or fewer.

A Datadog finding's related Jira ticket can be closed manually, but a Datadog finding remains open if Datadog cannot confirm that the issue is fixed. This restriction ensures that a finding is not closed and removed from the list of signals when someone closes a related Jira ticket.
A Datadog finding's related Jira ticket can be closed manually, but the Datadog finding remains open if Datadog cannot confirm that the issue is fixed. This restriction ensures that a finding is not closed and removed when someone closes a related Jira ticket.

Check notice on line 72 in content/en/security/ticketing_integrations.md

View workflow job for this annotation

GitHub Actions / vale

Datadog.sentencelength 

Suggestion: Try to keep your sentence length to 25 words or fewer.

Closing a Datadog case without remediation does not close the finding either.

Remediation of the finding in Datadog or defining an exception by muting the finding are the only ways to close a finding. Once the finding is remediated, its related cases and Jira tickets are closed.
Remediation of the finding in Datadog or defining an exception by [muting the finding][14] are the only ways to close a finding. Once the finding is remediated, its related cases and Jira tickets are closed.

Check warning on line 76 in content/en/security/ticketing_integrations.md

View workflow job for this annotation

GitHub Actions / vale

Datadog.words 

Use 'After' instead of 'Once'.

### Set up bidirectional syncing

The following steps set up bidirectional syncing with Jira and use Code Security vulnerabilities to verify that setup is successful.
The following steps set up bidirectional syncing with Jira and use Code Security findings to verify that setup is successful.

1. Set up the following prerequisites in your Datadog account, or verify that they are set up already. The prerequisites are listed in their setup order.
1. The [Datadog Jira integration][2].
Expand All @@ -70,8 +88,8 @@
2. In **Title**, select **Two-way sync**.
3. Complete the remaining settings, and then click **Save changes**.
2. Verify that bidirectional Case Management integration with Jira is working:
1. Open Code Security [Vulnerabilities][5].
2. Open any vulnerability.
1. Open Code Security [findings][5].
2. Open any finding.
3. Locate the **Create Ticket** option. The option is available in **Next Steps** or **Repositories** (in **Libraries (SCA)**).
4. Click the **Jira** tab.
5. Verify the **Sync with Datadog (via Case Management)** section exists.
Comment on lines -73 to 95
Copy link
Contributor

@VivianeQian VivianeQian Dec 31, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think the steps are not generic enough and it might not be clear for someone quickly going through the doc that it works for other finding types.

Maybe something like this would be better:

1. Open any supported product (and add links to code sec, cloud sec, etc.)
2. Open a Security Finding
3. Locate the **Create Ticket** option. The option is available in **Next Steps** or **Repositories** (in **Libraries (SCA)**). The button will open a **Create ticket** modal
4. Click the **Jira** tab.
5. Verify the **Case Management  <-> Jira Integration** section exists.

And add a screenshot with the expected result of the modal

Image

Expand All @@ -82,10 +100,10 @@

### Create bidirectional Case Management tickets

The following steps create a bidirectional Case Management ticket.
The following steps create a bidirectional Case Management ticket for a Code Security finding.

1. Open Code Security [Vulnerabilities][5].
2. Open any vulnerability.
1. Open Code Security [findings][5].
2. Open any finding.
3. Locate the **Create Ticket** option. The option is available in **Next Steps** or **Repositories** (in **Libraries (SCA)**).
4. Click the **Jira** tab. You can use a new or existing ticket. Let's look at creating new Jira ticket.
5. In **Sync with Datadog (via Case Management)**, complete the following settings:
Comment on lines +103 to 109
Copy link
Contributor

@VivianeQian VivianeQian Dec 31, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same comment as above about the generality of the steps.

Also the title of the section is Create bidirectional Case Management tickets but we talking about creating bi-synced Jira issues in the steps.

Maybe we could rename the section Create bidirectional tickets, keep the shared steps (1-3) and have collapsable sections for each ticketing tool (CM, Jira and soon SNOW) like CM did:

Image

Comment on lines +103 to 109
Copy link
Contributor

@VivianeQian VivianeQian Dec 31, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The Sync with Datadog (via Case Management) text is not in the modal anymore. iirc it was replaced with this and the rest of the config is done by clicking Manage

Image

Expand All @@ -103,9 +121,9 @@

### Manage bidirectional Case Management tickets

Existing bidirectional Jira tickets are listed in a signal or vulnerability's **Ticketing** or **Next Steps** sections.
Existing bidirectional Jira tickets are listed in a signal or finding's **Ticketing** or **Next Steps** sections.

Here's an example from a Static Code (SAST) vulnerability:
Here's an example from a Static Code (SAST) finding:

{{< img src="security/bidir-jira-existing.png" alt="signal with existing Jira ticket: in the Next Steps section, under Ticket Created, a pill with the Jira logo and text 'CJT-16'" responsive="true" style="width:100%;">}}

Expand All @@ -132,14 +150,31 @@

You can query attributes and create dashboards using these facets.

## Ticketing integration API

The link between Datadog Cases and existing Security findings can be managed via the public API.

Check warning on line 155 in content/en/security/ticketing_integrations.md

View workflow job for this annotation

GitHub Actions / vale

Datadog.words 

Use 'with' or 'through' instead of 'via'.

Dedicated endpoints allow users to [create Datadog case for existing security findings][15], [attach security findings to an existing Datadog case][16], and [detach security findings from their case][17].

Check notice on line 157 in content/en/security/ticketing_integrations.md

View workflow job for this annotation

GitHub Actions / vale

Datadog.sentencelength 

Suggestion: Try to keep your sentence length to 25 words or fewer.

User can also [create Jira issues for security findings][18] and [attach security findings to a Jira issue][19].


[1]: /service_management/case_management/
[2]: /integrations/jira/
[3]: /service_management/case_management/notifications_integrations/#third-party-tickets
[4]: https://app.datadoghq.com/security/siem/signals?column=time&order=desc&viz=stream
[5]: https://app.datadoghq.com/security/appsec/vm/library
[6]: https://app.datadoghq.com/security/appsec/signals?query=%40workflow.rule.type%3A%22Application%20Security%22&viz=stream
[7]: https://app.datadoghq.com/security/workload-protection/signals?query=%40workflow.rule.type%3A%22Workload%20Security%22
[4]: /security/siem/signals
[5]: /security/code-security
[6]: /security/appsec/signals
[7]: /security/workload-protection/signals
[8]: /integrations/jira/#configure-a-jira-webhook
[9]: /service_management/case_management/projects/
[10]: /security/ticketing_integrations/#prerequisites
[11]: /security/compliance
[12]: /security/appsec/inventory/finding
[13]: /security/workload-protection/findings
[14]: /security/automation_pipelines/mute
[15]: /api/latest/security-monitoring/#create-cases-for-security-findings
[16]: /api/latest/security-monitoring/#attach-security-findings-to-a-case
[17]: /api/latest/security-monitoring/#detach-security-findings-from-their-case
[18]: /api/latest/security-monitoring/#create-jira-issues-for-security-findings
[19]: /api/latest/security-monitoring/#attach-security-findings-to-a-jira-issue
Loading