Integrations

Open Integrations Settings

DNS Watchdog integrates with Jira Cloud so you can raise a Jira ticket directly from any security issue, about a whole zone, or for a copycat domain found by brand monitoring. Once connected, every issues table, the zones table and the brand-protection list gain a Jira column: it links to the associated ticket when one exists, and offers a Create action when it doesn't.

What you need

The account behind the API token needs permission to create issues in the target project. Tickets are created via the Jira Cloud REST API v3 using basic authentication (account email + API token).

Creating your credentials

You need four values from Jira. The API token is the only secret; the other three are visible in your Jira site.

1. Create an API token

1. Sign in to the Atlassian account you want DNS Watchdog to act as (see Use a dedicated account below — this doesn't have to be your personal login).
2. Go to id.atlassian.com → Account settings → Security → Create and manage API tokens.
3. Click Create API token — the plain, unscoped option. Do not use Create API token with scopes (see the callout below).
4. Give it a clear label such as DNS Watchdog so you can find and revoke it later.
5. Set an expiry. Atlassian tokens can expire between 1 day and 1 year — pick the shortest window your rotation process allows, and set a calendar reminder to replace it. Editing the connection with a fresh token before the old one expires avoids any gap.
6. Click Create, then Copy the token. Jira shows it once — paste it straight into the DNS Watchdog connect wizard, or hold it somewhere safe until you do. If you lose it, revoke it and create a new one.

2. Find your site URL

The site URL is the base address you use to reach Jira, e.g. https://your-site.atlassian.net. HTTPS is required. Use only the origin — no /jira or project path.

3. Find your account email

The account email is the email of the Atlassian account the token belongs to (step 1). Basic auth pairs this email with the token, so it must match the token's account exactly.

4. Find your project key

The project key is the uppercase prefix on that project's issue keys — in SEC-123 the key is SEC. You can also read it under Project settings → Details in Jira. This is the project new tickets are created in; the token's account must be able to create issues there.

Use a dedicated account (recommended)

For a security product, prefer least privilege over convenience:

• Create a dedicated Atlassian account (a service/bot user) rather than using a personal admin login. Add it to the target project with a role that can create issues and nothing more, so a leaked token can only file tickets in one project — not read or change the rest of your Jira.
• Set an expiry and rotate. Short-lived tokens limit the blast radius if one leaks.

DNS Watchdog stores the token write-only and encrypted (see below), but these steps limit what the credential can do in the first place.

Connecting Jira

Connecting runs a short wizard that checks each part against Jira before anything is saved, so you never store a connection that can't create tickets.

1. Navigate to Settings → Integrations and click Connect Jira.
2. Credentials. Enter your Jira site URL, account email, and API token, then click Next. DNS Watchdog calls Jira to confirm the credentials; if they're wrong, the error is shown here and you go no further.
3. Project. Pick your project. Projects the account can't create issues in are shown dimmed and can't be selected, so you only ever choose a usable one. The issue types you're allowed to create in the chosen project are listed — pick one (it defaults to Task). If no project is selectable, the account has no create permission anywhere; grant it Create Issues on a project in Jira and try again.
4. Review. Confirm the site, account, project, and issue type, then click Connect Jira to save.

Because the project and issue type are chosen from what Jira actually returns for your account, a wrong project key or an unavailable issue type is caught during setup rather than the first time you create a ticket. You can still use Test on the saved connection at any time to re-check the credentials.

How the API token is stored

The API token is write-only: it is stored encrypted in AWS SSM Parameter Store, scoped to your organisation, and is never returned by the API or shown in the UI again. When editing the connection, leave the token field blank to keep the stored token, or enter a new one to replace it.

Creating tickets from issues

With a connection configured, the Jira column appears in all issues tables — the main Issues page, zone issue lists, record detail pages, and delegated DNS listings — as well as in the issue details dialog.

Click Create on any issue to raise a ticket. The created ticket contains:

• Summary — the issue title and the affected host, e.g. Port 23 Open (Telnet) — host.example.com
• Description — issue type, severity, FQDN/IP/zone details, when it was first detected, and a link back to DNS Watchdog
• Labels — dns-watchdog plus a severity label such as severity-high

The ticket key (e.g. SEC-42) is stored on the issue and shown as a link to Jira. The link survives rescans — re-detecting the same issue never severs it — and each issue can be linked to one ticket.

Ticket creation requires the admin role; read-only members see the linked tickets but cannot create new ones.

Creating tickets for zones

You can also raise a ticket about a whole zone — for work that isn't tied to a single finding, such as a migration, an ownership review, or a clean-up. With a connection configured, the zone action appears in two places:

• the Jira column of the Zones table, with a Create button per zone
• a Create Jira ticket button in the header of each zone's detail page, next to Sync Zone

Unlike issue tickets, you write the content yourself. Clicking either opens a dialog with:

• Title — pre-filled with the zone name; edit it freely (Jira caps summaries at 255 characters)
• Description — required. Each line becomes a paragraph in the Jira ticket.

DNS Watchdog appends a footer to the description with the zone name, its provider, its record and open-issue counts, and a link back to the zone. The ticket is labelled dns-watchdog and zone.

The ticket key is stored on the zone and shown as a link in both places. The link survives re-syncs, and each zone can be linked to one ticket. Zone tickets follow the same role rules as issue tickets.

Creating tickets for copycat domains

Brand Protection findings get the same one-click action as issues: the Jira column of the findings list offers Create per finding, and the finding's detail view carries a Create Jira ticket button. The ticket is filled in for you — the domain, the brands it trades on, the assessed risk and threat types with the model's reasoning, the page title, and a link back to the finding — and is labelled dns-watchdog, copycat-domain and the risk band (for example high-risk).

The ticket key is stored on the finding and shown as a link wherever the finding appears. The link survives re-checks, and each finding can be linked to one ticket.

Connection status

Disconnecting

Click Disconnect to remove the connection. This deletes the stored API token and the connection configuration. Existing links from issues, zones and findings to Jira tickets are kept — only the ability to create new tickets is removed.

Troubleshooting