Configure Device Security and Cortex XSOAR

1. Log in to Device Security and then access the Jira Cloud instance settings in Cortex XSOAR.

   1. Log in to Device Security and select IntegrationsIntegration ManagementManage Integrations.

      Device Security uses Cortex XSOAR to integrate with Jira, and the settings you must configure are in the Cortex XSOAR interface.
   2. Launch Cortex XSOAR.

      The Cortex XSOAR interface opens in a new browser tab or window.
   3. Click Settings in the left navigation menu to go to IntegrationsInstances, and search for Jira Cloud to locate it among other instances.
2. Configure the settings for a Jira Cloud integration instance.

   1. Click the active integration instance settings icon, or click Add instance, to open the settings panel.
   2. Enter the following settings and leave the others at their default values:

      Name: Use the default name or enter a new one to help you identify the instance.

      Server URL: Enter the URL of your Jira Cloud server.

      Username: Enter your username for Jira Cloud.

      API Key: Enter the API token that you generated for Atlassian.

      Jira Project: Enter the full name for the Jira project where you want to create tickets, not the project code. This field is case-sensitive, and you can only input one project name.

      Jira Project Issue Type: Enter the issue type for issues that Device Security sends to Jira Cloud. You can only input one issue type, and this field is case-sensitive.

      Optional PANW Vulnerability Severities: Select the severity levels for open vulnerabilities that you want to send from Device Security to Jira Cloud. By default, Device Security sends only vulnerabilities with a severity level of Critical.

      PANW IoT Alert Severities: Select the severity levels for open alerts that you want to send from Device Security to Jira. By default, Device Security sends only alerts with a severity level of Critical.

      Optional Poll Interval in Days: Enter the time range, in days, that you want to poll for active alerts and vulnerabilities in Device Security to send to Jira Cloud. The default polling interval is one day.

   3. When finished, click Test or Test resultsRun test to test the integration instance.

      If the test is successful, a Success message appears. If not, check that the settings were entered correctly, and then test the configuration again.

   4. After the test succeeds, click Save & exit to save your changes and close the settings panel.
3. Enable the Jira Cloud integration instance.
4. Create a job for Cortex XSOAR to receive information from Jira.

   Depending on whether you want to bulk create tickets or bulk resolve alerts and vulnerabilities, select the appropriate playbook when configuring the job. You can create a job to bulk create Jira tickets from alerts and vulnerabilities, or you can create a job to periodically resolve alerts and vulnerabilities in Device Security based on their Jira ticket status. If you want to run multiple playbooks, you must create separate jobs, one for each playbook. You can also create multiple jobs if you have multiple integration instances.

   1. Click Jobs in the sidebar, and then click New Job to create a new Cortex XSOAR job.
   2. Configure the following settings in the New Job panel:

      1. Recurring: Select this if you want to periodically run the job. Clear it if you want to run the job on-demand.
      2. Optional Every: If you selected Recurring, enter a number and set the interval value (Minutes, Hours, Days, or Weeks) and select the days on which to run the job. If you don't select specific days, then the job will run every day by default. This determines how often Cortex XSOAR queries Jira for information.
         You can configure Queue Handling to determine what happens if a new job starts while an old job is still running.
      3. Name: Enter a name for the job.
      4. Playbook: Select the playbook depending on the type of job you're configuring:
         • Create PANW IoT Alert and Vulnerability Jira Tickets - Jira Integration — Create Jira tickets for all alerts or vulnerabilities that were active in the poll interval you specified when configuring the integration instance.
         • Update PANW IoT Alert and Vulnerabilities - Jira Integration — Resolve alerts and vulnerabilities in Device Security if their associated tickets are marked "Done" in Jira.
      5. Integration Instance Name: Enter the name of the Jira Cloud integration instance.
5. Enable the job and run it.

   Check the Job Status for the job you created. If it's Disabled, select its checkbox and then click Enable.

   You can immediately run the job by selecting it and clicking Run now. Otherwise, if you scheduled a recurring job, then the enabled job will run as scheduled.
6. Return to Device Security and check the status of the Jira integration instance.

   An integration instance can be in one of the following four states, which Device Security displays in the Status column on the Integrations page:

   • Active — the integration was configured and enabled and is functioning properly.
     Disabled — either the integration was configured but intentionally disabled or it was never configured and a job that references it is enabled and running.
   • Error — the integration was configured and enabled but is not functioning properly, possibly due to a configuration error or network condition.
   • Inactive — the integration was configured and enabled but no job has run for at least the past 60 minutes.

   When you see that the status of an integration instance is Active, its setup is complete.