Skip to main content

​
Overview

Link your Jira projects to automatically create and update issues based on Backline Vulnerabilities and Remediations. This integration uses Jira’s OAuth 2.0 (3LO) flow — you authorize Backline directly from your Atlassian account without creating a service account or generating an API token.
Backline supports Jira Cloud only. If you prefer to use an API token instead, see the Jira (API Token) integration.

​
What You Can Do

With the Jira integration, Backline can:
  • Automatically create a Jira ticket for a remediation when its pull request is opened
  • Route each remediation ticket to the right Jira project based on the affected application or repository
  • Set the new ticket’s fields — priority, status, and more — from your Backline remediation field mapping
  • Cross-link any existing vulnerability Jira tickets to the new remediation ticket
  • Track remediation work in your team’s existing workflow

​
Prerequisites

Before connecting, ensure you have:
  • A Jira Cloud instance
  • Permission to authorize third-party apps in your Atlassian account

​
Connecting Jira

1

Navigate to Integrations

In Backline, go to the Integration Hub from the main menu.
2

Select Jira (App)

Find and click on the Jira (App) integration card.
3

Authorize with App

Click Connect to start the Jira App (OAuth) flow. You’ll be redirected to Atlassian to review and approve Backline’s requested permissions.
4

Approve Access

On Atlassian, select the required site, review the permissions and click Accept to grant Backline access to your Jira site.
5

Return to Backline

Once authorized, Atlassian redirects you back to Backline. Your session is now linked securely — no token storage on your end.

​
Configuring Projects

After connecting, configure which Jira projects Backline should use:
1

Open Project Management

From the Jira (App) integration card, click Add Projects (shown after connection) or open the card and go to the Management tab.
2

Select Jira Project

Choose a Jira Project from the list of available projects in your connected site.
3

Choose Issue Type

Select the issue type you want Backline to create for remediation tickets in this project.
4

Map Fields

Once the issue type is chosen, the mandatory and optional fields from Jira appear. Map each Jira field to one of the following:
  • A value from Jira
  • A Backline remediation field (see below)
  • A manually entered value
The Backline remediation fields available for mapping are Remediation Status, Remediation Priority, Remediation Mode, Remediation Type, Remediation Title, Highest Severity, and Time to SLA. Map Jira fields such as Priority and Status to the matching Backline remediation field so Backline can set them on the tickets it creates.
5

Save Configuration

Complete the field mapping and save your project configuration.

​
Automatic Remediation Tickets

Backline creates Jira tickets at the remediation level — one ticket for a fix that may span several vulnerabilities. Backline does not create tickets for individual vulnerabilities.

​
When tickets are created

When Auto-Create Ticket is enabled, Backline creates a remediation ticket when a pull request is opened for the remediation. If the remediation already has a ticket, Backline does not create another one.

​
Ticket content

Each ticket is composed automatically from the remediation record and includes:
  • A short summary of the vulnerabilities addressed and the fix applied
  • Remediation details — title, type, mode, and priority
  • Impact — highest severity, number of affected vulnerabilities, affected application/service, and repository or image
  • A recommended action — review and merge the pull request
  • Links back to the Backline remediation and the pull request
On creation, Backline sets the ticket’s Jira fields from your field mapping (see Map Fields), and links any existing vulnerability Jira tickets on the remediation’s vulnerabilities to the new ticket.
Remediation tickets are created unassigned. Connect a messaging integration like Slack to be alerted if a ticket can’t be created after automatic retries.

​
Configuration

The Configuration tab — shown right after you connect — is where you set up automatic remediation tickets.

​
Auto-Create Ticket

Toggle Auto-Create Ticket on to let Backline create a ticket when a remediation’s pull request is opened. It is off by default: no remediation tickets are created until you enable it.

​
Global Ticket Title Template

Define the title format for the Jira tickets Backline creates, so titles stay consistent and easy to search. The default is:
Combine free text with any of these tokens, in any order: A token with no value for a given remediation is dropped from the title without failing ticket creation.

​
Project routing

Remediation tickets are routed to a Jira project based on the affected application or repository:
  • Project Mapping — upload a CSV that maps each application or repository to a Jira project. Download the template (pre-filled with your known repositories and detected applications), fill in the jira_project_name column, and upload it. After upload, a preview lists every row with its resolved status; rows that fail validation — unknown identifier, Jira project not found, or missing/duplicate identifier — are flagged and skipped. You can also override specific Jira fields per row.
  • Default Jira Project — the fallback project for any application or repository not covered by the mapping. A Default Jira Project is required before the integration can be activated.
The CSV has four columns — jira_project_name, application, repository_url, and the optional field_overrides. Each row maps one Jira project to exactly one identifier — either an application or a repository_url, leaving the other blank:
Uploading a new mapping merges into the existing one — adding or updating rows — and never removes rows absent from the new file. Identifiers are stored by a stable internal ID, so renaming an application or repository later won’t break routing. The issue type for created tickets comes from the destination Jira project’s own default issue type, so no extra configuration is needed.

​
Overriding fields per repository or application

By default, every ticket a project creates uses that project’s field mapping. The optional field_overrides column lets a single repository or application set its own values for specific Jira fields, on top of the project mapping — for example, routing a repo’s tickets to a different component or parent epic, or giving one repo a higher priority. Leave the column blank to use the project’s field mapping unchanged. When set, it’s a JSON object keyed by the Jira field’s display name (exactly as it appears in the field mapping). Only the fields you list are overridden; everything else keeps the project default. Priority and Status are keyed because Backline maps them from the remediation’s own priority (P1/P2/P3) or status (PendingApproval, ManualFix) — so you provide a value per key, just like in the field-mapping UI. Because the value contains commas and quotes, wrap the whole JSON object in double quotes and double every inner quote (standard CSV escaping):
All values are validated on upload against the destination project: each field name and value must resolve to a real Jira field and option. If any value is invalid — an unknown field, a value that isn’t a valid option, a parent key that doesn’t exist, or the wrong shape for the field — that row is flagged and skipped, and the rest of the upload is rejected, so a bad override never reaches ticket creation.

​
Managing the Integration

​
Managing Projects

To view and manage your connected Jira projects:
1

Open Project Management

From the Jira (App) integration card, click the three dots menu and choose Manage Projects.
2

View Connected Projects

You’ll see all connected Jira projects listed.
3

Edit or Delete

For each connected project, you can:
  • Edit the configuration to modify field mappings or issue types
  • Delete the project to remove the connection
4

Add More Projects

Click Add Project to configure additional Jira projects.

​
Revoking Access

To revoke Backline’s access to your Jira account:
  1. Disconnect the integration from the Backline Integration Hub
  2. Optionally, revoke the app from your Atlassian Connected Apps page
Connect a messaging integration like Slack to receive notifications if there’s an issue connecting or updating a ticket during the remediation process.