Jira Plugins

Jira Plugins

SecureFlag Knowledge Base for Jira Plugins

Contextual software security training for Jira issues, powered by the SecureFlag knowledge base.

This app responds to issues that mention security vulnerabilities, with a recommended lab and information from the SecureFlag Knowledge Base. Each reply includes an overview of everything a developer needs to know in order to understand and remediate a given type of vulnerability, including example code!

We know that not all developers are security professionals, so CWE (Common Weakness Enumeration) numbers for common vulnerabilities are mapped to the Knowledge Base, providing a description of the vulnerability that is quick and easy to use and apply.

Jira Cloud Plugin
Jira Data Center Plugin
Jira Cloud Plugin

Installation

Access the app via the Atlassian marketplace here .

Click the Get it now button and select the site on which you wish to install the app.

Admin Settings

Jira administrators can configure:
  1. Project Filter: Controls the app's availability for specific projects.
  2. Issue Type & Label Filter: Restricts the app's visibility by targeting specific issue types and labels.
  3. Match Issue Title Only: Choose whether matching uses only the issue title, or the full title and description for broader context.
  4. AI Enhanced Matching: Enables AI-powered knowledge base matching for more accurate, context-aware results.

Accessing the Configuration

  1. Navigate to the Apps section from the left-hand panel, click the "⋯"  (More actions) icon, and select Manage apps.



  2. In Manage apps, you may see a notification stating that app management has moved to Administration. Click Take me there to continue.



  3. Locate the app in the list, select the "⋯"  icon, and choose Configure to access its settings.

Configuration Options

Plugin Visibility Settings

  1. Project Filter: Enable this toggle to restrict the app to specific projects.
  2. Issue Types & Labels Filter: Enable this toggle to restrict the app by issue type or label.

Once a filter is enabled, use the corresponding multi-select dropdown to select the applicable projects, issue types, or labels.

NotesNote: If a filter toggle is turned off, the app will remain active for all options in that category by default.


Match Issue Title Only

  1. Match Title Only: Enable this toggle to limit matching to the issue title only.

When the toggle is off, matching uses the full issue title and description. This is the default behavior.

AI Enhanced Matching

  1. Enable AI Enhanced Matching: Enable this toggle to activate AI-enhanced knowledge base matching.
  2. SecureFlag API Access Token: Enter the API access token generated in the SecureFlag Management Portal.



How to generate SecureFlag API Access Token:
  1. Log in to SecureFlag as an Organization Admin. In the Management Portal, click the Settings icon in the top-right corner of the navigation bar.
  2. Scroll to the API Access Tokens section. Select either Read knowledge base or Full Access as the scope, then enter a name for the token and click Generate.
  3. Copy and save the token displayed in the modal as it will not be shown again.

Saving the configuration

After configuring your settings, click Save to apply the changes.

Usage

Simply mention a software vulnerability by name or CWE number in an issue, in either the title or body, and the bot will reply. Common abbreviations are supported as well.

For example:
Quote
Hey, there's a XXE vulnerability here. Please fix ASAP.

Hm, there is another XML Entity Expansion vulnerability. Please audit all HTML forms.

The above steps will instigate a response like the one below:


Jira Data Center Plugin

Installation

Before installing the app, check that your Jira instance can access the knowledge-base-api.secureflag.com and knowledge-base.secureflag.com domains, as these are necessary for the app to work. If you have a firewall, it may interfere. These can be tested by running the following:


This should return HTTP/2 400.

curl --silent -i https://knowledge-base.secureflag.com | head -n 1

This should return HTTP/2 200.

Installing directly on the Jira instance:
  1. Log in to your instance of Jira as an admin.
  2. Select the Settings dropdown menu (gear icon on the top right) and choose Manage apps.
  3. Select Find new apps from the left-hand menu.
  4. Once the screen loads, type SecureFlag Knowledge Base in the search bar to find the appropriate app version.
  5. Select Install and follow the prompts to install the app.

Alternatively, you can install the app via Atlassian Marketplace as follows:
  1. Click the Get it now button to download the plugin .obr file.
  2. Within Jira, navigate to the Manage apps or Manage add-ons page. This can be done by clicking on the settings icon at the top right, and clicking either Manage apps or Add-ons, depending on your Jira version. Then, from the sidebar on the left, go to Manage add-ons or Manage apps.
  3. Click on the Upload app link. Then, click Choose File and navigate to where the knowledgebase-X.X.X.obr file was downloaded. Select it.
  4. Click Upload to install the plugin.
  5. A progress bar should be presented. Wait for Jira to finish installing the plugin.
  6. Done!

Admin Settings

Jira administrators can configure:
  1. Project Filter: Control the app's availability for specific projects.
  2. Issue Type & Label Filter: Restrict the app's visibility by targeting specific issue types and labels.
  3. Proxy Settings: Route app traffic through a proxy, with configurable host and port for environments with restricted outbound network access.
  4. Match Issue Title Only: Choose whether matching uses only the issue title or the full title and description for broader context.
  5. AI Enhanced Matching: Enable AI-powered knowledge base matching for more accurate, context-aware results.

Accessing the Configuration

  1. Navigate to Settings (the gear icon on the top right) in the top navigation bar and select Manage apps.



  2. Select Manage apps from the left navigation pane.

  3. Locate the app in the list and click on it to open the details view.

  4. Click Configure to access the settings.



Configuration Options

Plugin Visibility Settings

Admins can set the plugin visibility controls based on the following options:
  1. Project Filter: Enable this toggle to restrict the app to specific projects.
  2. Issue Types & Labels Filter: Enable this toggle to restrict the app based on issue types or labels.
  3. Once a filter is enabled, use the corresponding multi-select dropdown to choose the applicable projects, issue types, or labels.

NotesNote: If a filter toggle remains off, the app will be enabled for all options in that category by default.

Proxy Settings

In this section admins can optionally configure proxy settings for the app with the following options:
  1. Proxy Enabled: Toggle this option on if your environment requires routing external requests through a proxy server.
  2. Host: Specify the hostname or IP address of the proxy server.
  3. Port: Enter the port number used by the proxy server to handle outgoing connections.


Match Issue Title Only

  1. Match Title Only: Enable this toggle to limit matching to the issue title alone.

When the toggle is off, matching uses the full issue title and description. This is the default behavior.

AI Enhanced Matching

  1. Enable AI Enhanced Matching: Enable this toggle to activate AI-enhanced knowledge base matching.
  2. SecureFlag API Access Token: Enter the API access token generated in the SecureFlag Management Portal.


How to generate SecureFlag API Access Token:
  1. Log in to SecureFlag as an Organization Admin. In the Management Portal, click the Settings icon in the top-right corner of the navigation bar.
  2. Scroll to the API Access Tokens section. Select either Read knowledge base or Full Access as the scope, then enter a name for the token and click Generate.
  3. Copy and save the token displayed in the modal as it will not be shown again.

Saving the Configuration

After configuring your settings, click Save to apply the changes.

Usage

The plugin can be found in the right hand side of the issue view. It will automatically attempt to find a relevant training article from the content of the issue, and display a result accordingly.



By default, it provides a technology-specific article, however by selecting a technology from the dropdown, a custom technology can be selected.


 

    • Related Articles

    • SecureFlag ThreatCanvas for Jira

      AI-powered threat modelling -- for Jira Cloud and Jira Data Center! SecureFlag ThreatCanvas for Jira Cloud and Jira Data Center enables developers to easily generate threat models from issues describing new features or changes to be made. ...

    • SonarQube Plugin

      Contextual software security training for detected vulnerabilities and Security Hotspots. This plugin lists recent vulnerabilities and security hotspots detected by SonarQube, then attempts to find relevant training labs and remediation advice from ...

    • SecureFlag Analyzer Plugin for IntelliJ IDEA

      AI-powered vulnerability detection, right in your IDE. Overview The SecureFlag Analyzer plugin integrates with IntelliJ IDEA to deliver real-time security analysis as you code. Powered by advanced LLMs (Anthropic and ChatGPT), it detects potential ...

    • SecureFlag Findings2Training Plugin for IntelliJ IDEA

      SecureFlag Findings2Training is an IntelliJ IDEA plugin that watches for security issues in your project and automatically recommends the relevant training articles and hands-on practice labs to help you understand and fix them. Prerequisites Before ...