JIRA

NightVision files Jira tickets directly with the nightvision export jira CLI command, and syncs Jira status changes back to findings from the NightVision app. See Jira for that built-in integration. The script below is an alternative for teams that already produce a SARIF file and prefer to run their own ticket-filing step.

Description

This repository contains scripts and configurations to interact with Jira and manage project vulnerabilities using NightVision SARIF reports.

Jira Integration Repository

Preview: Example Results

NightVision explains how the vulnerability was exploited, why it matters, and where to fix it.

Prerequisites

• Python 3.x
• Jira account and API token
• NightVision account

Setup

1. Clone the repository:

   git clone https://github.com/nvsecurity/jira-issue-from-sarif.git
   cd jira-issue-from-sarif

2. Install required packages:

   pip install jira

3. Set environment variables (or pass these arguments directly to the scripts):

   export JIRA_URL='your_jira_url'
   export JIRA_USER_EMAIL='your_jira_user_email@example.com'
   export JIRA_API_TOKEN='your_jira_api_token'   # see Create Jira API Token below
   
   export JIRA_PROJECT_ID='your_jira_project_id' # see Find Jira Project ID below
   export JIRA_ISSUE_TYPE='your_jira_issue_type' # optional, defaults to 'Task'
   export JIRA_COMPONENT='your_jira_component'   # optional

Usage

Create Jira API Token

1. Go to Jira API tokens.
2. Create a new API token and copy it.

Find Jira Project ID

1. Run the following command to get Jira project IDs:

   python get-jira-project-id.py

   Usage:

   usage: python get-jira-project-id.py [-h] --url URL --email EMAIL --token TOKEN
   
   Create Jira tickets from SARIF report.
   
   optional arguments:
   -h, --help     show this help message and exit
   
   Jira server credentials:
   --url URL      Jira server URL (JIRA_URL environment variable)
   --email EMAIL  Jira user email (JIRA_USER_EMAIL environment variable)
   --token TOKEN  Jira API token (JIRA_API_TOKEN environment variable)

2. Select the Jira Project ID you need. Example output:

   Projects Available: 2
   
   1
   Project ID: 10001
   Name      : NightVision
   Key       : NV
   
   2
   Project ID: 10004
   Name      : NV Sales
   Key       : NS

Create Tickets from SARIF

1. Export NightVision SARIF report for a specific scan:

   nightvision export sarif -s "your_scan_id" --swagger-file "./your/swagger/file/path.yaml"

   This should create a results.sarif file in your current directory.

2. Create Jira tickets from the SARIF report:

   python sarif-to-jira.py -p "your_project_id"

   Usage:

   usage: python sarif-to-jira.py [-h] --url URL --email EMAIL --token TOKEN -p PROJECT-ID -i TYPE -c COMPONENT
                                  [--sarif-file SARIF_FILE] [--dry-run] [--max-issues N]
   
   Create Jira tickets from a NightVision SARIF report (deduped, severity-mapped).
   
   optional arguments:
   -h, --help            show this help message and exit
   
   Jira server credentials:
   --url URL             Jira server URL (JIRA_URL environment variable)
   --email EMAIL         Jira user email (JIRA_USER_EMAIL environment variable)
   --token TOKEN         Jira API token (JIRA_API_TOKEN environment variable)
   
   Issue properties:
   -p PROJECT-ID, --project-id PROJECT-ID
                           Jira Project ID (JIRA_PROJECT_ID environment variable)
   -i TYPE, --issue-type TYPE
                           Issue type - defaults to 'Task' (JIRA_ISSUE_TYPE environment variable)
   -c COMPONENT, --component COMPONENT
                           Issue component (JIRA_COMPONENT environment variable)
   
   Run options:
   --sarif-file SARIF_FILE
                           Path to the SARIF report - defaults to 'results.sarif'
   --dry-run               Report what would be created without creating any Jira issues
   --max-issues N          Stop after N issues are created

De-duplication, re-runs, and severity

Every ticket the script creates carries two Jira labels: a constant nightvision label and a per-finding nv-fingerprint:<key> label. Before creating a ticket, the script searches the project for that nv-fingerprint:<key> label and skips the finding if a ticket already exists:

• Running the script repeatedly against the same scan creates each ticket once; re-runs only fill gaps. Tickets are never updated or closed by this script.

• Finding severity is mapped to a Jira priority (CRITICAL to Highest, HIGH to High, MEDIUM to Medium, LOW to Low, INFO to Lowest). The priority is applied only if your Jira priority scheme defines that name; otherwise it is omitted.

• Use --dry-run to preview what would be created versus skipped, and --max-issues N to cap large reports. --dry-run still connects to Jira for the dedup search, so it requires valid credentials.