Onboard an Atlassian App to SSPM

Table of Contents

Onboard an Atlassian App to SSPM

Connect an Atlassian instance to SSPM to detect posture and identity risks, and to enable third-party plugin scans for Jira and Confluence.

Where Can I Use This?	What Do I Need?
Strata Cloud Manager	SaaS Security Posture Management license Or any of the following licenses that include the Data Security license: CASB-X CASB-PA

Where Can I Use This?

What Do I Need?

Strata Cloud Manager

SaaS Security Posture Management license

Or any of the following licenses that include the Data Security license:

CASB-X
CASB-PA

For SSPM to detect posture risks in your Atlassian instance, you must onboard your Atlassian instance to SSPM. Through the onboarding process, SSPM connects to an Atlassian API and, through the API, scans the Atlassian Administration settings for your organization. If there are misconfigured settings, SSPM suggests a remediation action based on best practices. SSPM also runs identity scans for account risks.

Some of the Atlassian Administration settings that SSPM scans affect Jira and Confluence. These are high-level Atlassian Administration settings for your organization, and will differ depending on whether your organization has the free, Standard, or Premium versions of these products. To have SSPM scan settings at the Jira and Confluence level, you must onboard a Jira app and onboard a Confluence app.

If users have extended the capabilities of Jira and Confluence by installing third-party plugins, SSPM also detects the third-party plugins and the access that the plugins were granted. This information helps you determine the risks posed by third-party plugins so you can take action as needed. It is not necessary to onboard Jira and Confluence to SSPM to enable these third-party plugin scans.

To access your Atlassian instance, SSPM requires the following information, which you will specify during the onboarding process.

Item	Description
API Token	A token, generated by an Atlassian Org Admin, that enables SSPM to authenticate to the administrator account.
API Key	A key, generated by an Atlassian Org Admin, that enables SSPM to scan and update organization settings and user accounts. SSPM uses this key to identify and manage the third-party plugins that users have connected to Jira or Confluence.
Admin Email	The login email address of the Atlassian Org Admin who created the API token and API key.

To onboard your Atlassian instance, you complete the following actions:

Generate and Copy an administrator API token.

To authenticate to an administrator account using an Atlassion API, SSPM requires an administrator API token.
1. Log in to Atlassian using Org Admin credentials.
2. From the Atlassian account profile, navigate to the API tokens page for the account. To do this, select Security Create and manage API tokens or go directly to this URL: id.atlassian.com/manage-profile/security/api-tokens.
3. Create API Token.
  
  A dialog prompts you to specify a label for the API token.
4. Specify a label and Create the API token.
  
  Atlassian generates and displays your new API token.
5. Copy the API token and paste it into a text file.
  
  Do not continue to the next step unless you have copied the API token. You must provide this token to SSPM during the onboarding process.
Generate and copy an API key for your organization.

To identify and manage the third-party plugins that users have connected to Jira or Confluence, SSPM requires an API key generated from an administrator account. SSPM also requires this API key for identity scans.
1. Log in to the Atlassian Admin Portal using Org Admin credentials.
2. If you administer more than one Atlassian organization, select the organization you want SSPM to scan for third-party plugins.
3. From the left navigation, select Organization settings API keys.
4. On the API keys page, click Create API key.
5. On the Before you begin page, select API key without scopes and click Next.
  
  You must select the API key without scopes option. SSPM does not support scoped API keys.
6. In the Create an API key dialog, specify a name and an expiration date for the key and Create the key.
  
  Atlassian generates and displays a new API key.
7. Copy the API key and paste it into a text file.
  
  Do not continue to the next step unless you have copied the API key. You must provide this key to SSPM during the onboarding process.
Connect SSPM to your Atlassian instance.

In SSPM, complete the following steps to enable SSPM to connect to your Atlassian instance for posture and identity scans. By connecting the Atlassian app, you also enable SSPM to scan for third-party plugins connected to Jira and Confluence.
1. Log in to Strata Cloud Manager.
2. Select ConfigurationSaaS SecurityPosture SecurityApplicationsAdd Application and click the Atlassian tile.
3. On the Posture Security tab, Add New instance.
4. Log in with Credentials.
5. Enter the login email address of the Atlassian administrator who created the API token, the API token, and the API key.
6. Connect.