# Create new issue in Jira for each event in a detection

**URL:** https://discuss.elastic.co/t/create-new-issue-in-jira-for-each-event-in-a-detection/270744
**Category:** Elastic Security
**Tags:** detection-rules
**Created:** [April 20, 2021, 5:23pm UTC](https://discuss.elastic.co/t/create-new-issue-in-jira-for-each-event-in-a-detection/270744 "2021-04-20T17:23:24Z")
**Posts on this page:** 12
**Page:** 1

<div class="post-metadata">

### Author: ![Felipe\_Fuller](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/felipe_fuller/32/80377_2.png) [@Felipe\_Fuller](https://discuss.elastic.co/u/Felipe_Fuller)
#### Post date: [April 20, 2021, 5:23pm UTC](https://discuss.elastic.co/t/create-new-issue-in-jira-for-each-event-in-a-detection/270744/1 "2021-04-20T17:23:24Z")

</div>

Hi Community! I hope that you are doing great!

I'm trying to send an issue per event in a detection, but I'm struggling to find any solution.

 ![Captura de Pantalla 2021-04-20 a la(s) 13.19.55](https://us1.discourse-cdn.com/elastic/original/3X/7/b/7beffffabd46e833be92ae823b3871955edef6f0.png)

So in this case, there should be 5 issues created in Jira.

Thank you very much!

---

<div class="post-metadata">

### Author: ![Jonathan\_Buttner](https://avatars.discourse-cdn.com/v4/letter/j/9d8465/32.png) [@Jonathan\_Buttner](https://discuss.elastic.co/u/Jonathan_Buttner)
#### Post date: [April 22, 2021, 5:49pm UTC](https://discuss.elastic.co/t/create-new-issue-in-jira-for-each-event-in-a-detection/270744/2 "2021-04-22T17:49:00Z")

</div>

Hi @Felipe_Fuller ,

Thanks for your question! During the detection rule creation workflow you have the option of setting up an alert notification as described here: [Create a detection rule | Elastic Security Solution [7.12] | Elastic](https://www.elastic.co/guide/en/security/current/rules-ui-create.html#rule-notifications)

Some additional Jira connector documentation can be found here:

> **[Jira connector and action | Kibana Guide \[master\] | Elastic](https://www.elastic.co/guide/en/kibana/master/jira-action-type.html)**

Were you able to setup the Jira action connector? For testing you could set the frequency to be _On each rule execution_ to make sure it gets run each time an alert is created.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/8/2/82bb40b387898ed1ac5d0204b6acb4f3c92dc0b6.png)

Jonathan

---

<div class="post-metadata">

### Author: ![Felipe\_Fuller](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/felipe_fuller/32/80377_2.png) [@Felipe\_Fuller](https://discuss.elastic.co/u/Felipe_Fuller)
#### Post date: [April 23, 2021, 5:08pm UTC](https://discuss.elastic.co/t/create-new-issue-in-jira-for-each-event-in-a-detection/270744/3 "2021-04-23T17:08:16Z")

</div>

Hi @Jonathan_Buttner !

Yes! the problem is that I want to create one issue in Jira per event detected. But actually, is sending the information of all the events in one issue.

Is there any possible solution to send them in different issues?

Thank you in advance

---

<div class="post-metadata">

### Author: ![Jonathan\_Buttner](https://avatars.discourse-cdn.com/v4/letter/j/9d8465/32.png) [@Jonathan\_Buttner](https://discuss.elastic.co/u/Jonathan_Buttner)
#### Post date: [April 23, 2021, 6:49pm UTC](https://discuss.elastic.co/t/create-new-issue-in-jira-for-each-event-in-a-detection/270744/4 "2021-04-23T18:49:52Z")

</div>

Oh sorry I misunderstood! Unfortunately, this isn't a way to do that currently. There's a similar request for the ServiceNow integration so it is in our backlog of features to work on 😀

> <https://github.com/elastic/kibana/issues/97662>
>
> Describe the feature:
> When a detection signal is configured to use a ServiceNow connector, it should give user an option to create...

---

<div class="post-metadata">

### Author: ![Felipe\_Fuller](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/felipe_fuller/32/80377_2.png) [@Felipe\_Fuller](https://discuss.elastic.co/u/Felipe_Fuller)
#### Post date: [April 23, 2021, 7:42pm UTC](https://discuss.elastic.co/t/create-new-issue-in-jira-for-each-event-in-a-detection/270744/5 "2021-04-23T19:42:33Z")

</div>

Thank you very much @Jonathan_Buttner! Should I open a new issue to suggest this implementation, or will it be considered for Jira?

---

<div class="post-metadata">

### Author: ![Jonathan\_Buttner](https://avatars.discourse-cdn.com/v4/letter/j/9d8465/32.png) [@Jonathan\_Buttner](https://discuss.elastic.co/u/Jonathan_Buttner)
#### Post date: [April 23, 2021, 7:57pm UTC](https://discuss.elastic.co/t/create-new-issue-in-jira-for-each-event-in-a-detection/270744/6 "2021-04-23T19:57:25Z")

</div>

Yeah no problem! I would just post on that issue I linked stating that you'd like to have the functionality for Jira as well.

---

<div class="post-metadata">

### Author: ![austinsonger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/austinsonger/32/78994_2.png) [@austinsonger](https://discuss.elastic.co/u/austinsonger)
#### Post date: [April 25, 2021, 5:48am UTC](https://discuss.elastic.co/t/create-new-issue-in-jira-for-each-event-in-a-detection/270744/7 "2021-04-25T05:48:42Z")

</div>

@Jonathan_Buttner and @Felipe_Fuller you can check out my github that goes over creating detections for each rule triggered to create tickets for each in JIRA Tickets.

[austinsonger/Elastic-Security: Elastic Automations for Elastic SIEM using Bash (github.com)](https://github.com/austinsonger/Elastic-Security)

> If this solves your issue, please make sure you select this answer as the solution.

---

<div class="post-metadata">

### Author: ![Felipe\_Fuller](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/felipe_fuller/32/80377_2.png) [@Felipe\_Fuller](https://discuss.elastic.co/u/Felipe_Fuller)
#### Post date: [April 26, 2021, 2:09pm UTC](https://discuss.elastic.co/t/create-new-issue-in-jira-for-each-event-in-a-detection/270744/8 "2021-04-26T14:09:18Z")

</div>

@austinsonger but this will create a new issue per event detected or a new issue per rule triggered?

---

<div class="post-metadata">

### Author: ![austinsonger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/austinsonger/32/78994_2.png) [@austinsonger](https://discuss.elastic.co/u/austinsonger)
#### Post date: [April 27, 2021, 12:08am UTC](https://discuss.elastic.co/t/create-new-issue-in-jira-for-each-event-in-a-detection/270744/9 "2021-04-27T00:08:43Z")

</div>

For everytime that a event triggers a detection rule.

---

<div class="post-metadata">

### Author: ![Felipe\_Fuller](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/felipe_fuller/32/80377_2.png) [@Felipe\_Fuller](https://discuss.elastic.co/u/Felipe_Fuller)
#### Post date: [May 6, 2021, 4:04pm UTC](https://discuss.elastic.co/t/create-new-issue-in-jira-for-each-event-in-a-detection/270744/10 "2021-05-06T16:04:32Z")

</div>

@austinsonger, thank you for all the help! The problem is that when I use your solution, I receive all the events in one ticket, not one ticket per event. What could be the issue?

---

<div class="post-metadata">

### Author: ![austinsonger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/austinsonger/32/78994_2.png) [@austinsonger](https://discuss.elastic.co/u/austinsonger)
#### Post date: [May 6, 2021, 10:52pm UTC](https://discuss.elastic.co/t/create-new-issue-in-jira-for-each-event-in-a-detection/270744/11 "2021-05-06T22:52:10Z")

</div>

You shouldn't want a ticket to be created for every event log, that will be extremely noisy. But if you really want that... you can change the interval for how often the rule runs. But there is no high ranking SIEM tool out there that will create a new alarm for every event individual event that matches a SIEM Alarm rule. I wouldn't work in this industry if that how those tools worked.

But if you want that, then please look at the screenshot I prepared below.

 ![](https://us1.discourse-cdn.com/elastic/original/3X/1/f/1f39c73ab2c9d987b565d24112cbe5310e7a335a.png)

And below is a example of how alienVault works and it is pretty much the same.

 ![](https://us1.discourse-cdn.com/elastic/original/3X/8/9/897a5270d933858ffdcdfb8380066978a8cc1674.png)

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 3, 2021, 10:52pm UTC](https://discuss.elastic.co/t/create-new-issue-in-jira-for-each-event-in-a-detection/270744/12 "2021-06-03T22:52:27Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
