Onboard an Atlassian App to SSPM
Table of Contents
Onboard an Atlassian App to SSPM
Onboard an Atlassian app to enable third-party plugin scans for Jira and
Confluence.
Users can extend the capabilities of Jira and Confluence by installing third-party
plugins from the Atlassian Marketplace. These third-party plugins can pose a
security risk to your organization if, for example, users install plugins that are
not sanctioned by your organization, or if they grant permissions that expose
sensitive data to the plugin.
By onboarding an Atlassian app, you enable SSPM to scan your Jira and Confluence
instances for connected third-party plugins. To enable these scans, you must also
onboard the Jira app or onboard the Confluence app. From SSPM, you can then view
the third party plugins for Jira or Confluence and take action if necessary.
To access your Atlassian instance, SSPM requires the following information, which you
will specify during the onboarding process.
Item | Description |
|---|---|
API Token | A token, generated by an Atlassian administrator, that enables
SSPM to authenticate to the administrator account. |
API Key | A key, generated by an Atlassian administrator, that enables SSPM
to scan and update organization settings and user accounts. SSPM
uses this key to identify and manage the third-party plugins that
users have connected to Jira or Confluence. |
Admin Email | The login email address of the Atlassian administrator who
created the API token. |
To onboard your Atlassian instance, you complete the following actions:
Generate and Copy an Administrator API Token
To authenticate to an administrator account using an
Atlassion API, SSPM requires an administrator API token.
- Log in to Atlassian using administrator credentials.
- From the Atlassian account profile, navigate to the API tokens page for the account. To do this, select or go directly to this URL: id.atlassian.com/manage-profile/security/api-tokens.
- Create API Token.
A dialog prompts you to specify a label for the API token. - Specify a label andCreatethe API token.Atlassian generates and displays your new API token.
- Copy the API token and paste it into a text file.Do not continue to the next step unless you have copied the API token. You must provide this token to SSPM during the onboarding process.
Generate and Copy an API Key for Your Organization
To identify and manage the third-party plugins that users have connected to Jira
or Confluence, SSPM requires an API key generated from an administrator
account.
- Log in to the Atlassian Admin Portal using administrator credentials.
- If you administer more than one Atlassian organization, select the organization you want SSPM to scan for third-party plugins.
- Select .
- On the API keys page, clickCreate API key.
- In the Create an API key dialog, specify a name and an expiration date for the key andCreatethe key.Atlassian generates and displays a new API key.
- Copy the API key and paste it into a text file.Do not continue to the next step unless you have copied the API key. You must provide this key to SSPM during the onboarding process.
Connect SSPM to Your Atlassian Instance
By adding an Atlassian app in SSPM, you enable SSPM to
scan for third-party plugins connected to Jira and Confluence.
- From the Add Application page (), click the Atlassian tile.
- Under posture security instances,Add Instanceor, if there is already an instance configured,Add Newinstance.
- Choose the option toLog in with Credentials.
- Enter the login email address of the Atlassian administrator who created the API token, the API token, and the API key.
- Connect.