Jira Automation | cside docs

You can turn any cside notification into a Jira work item by pointing a webhook destination at a Jira Automation rule. This works on every plan, and it is the way to get digests such as PCI Report Available and Script Blocked by CSP into Jira, since the Jira integration does not deliver digests.

Put the Jira secret in the URL

Jira Automation expects its secret in an X-Automation-Webhook-Token header. cside webhooks cannot send custom headers, so add the secret to the end of the webhook URL instead, as Atlassian documents for senders without custom headers. Without it, Jira rejects every request with HTTP 400.

Jira Automation or the Jira integration?

The Jira integration connects cside to Jira over OAuth and creates one issue per alert with a details table and a dashboard link. It is included on the Enterprise plan and handles the immediate triggers only.

A Jira Automation rule fed by a webhook works on any plan and for every trigger, including the digests. You decide in Jira what the work item looks like.

What you’ll need

Permission to create automation rules in your Jira project
A cside notification config for the alerts you want in Jira

Create the rule in Jira

Add an incoming webhook trigger

In your Jira project, open Project settings > Automation and create a rule. Choose the Incoming webhook trigger and set Execute this rule with to No work items from the webhook (some Jira sites still label it No issues from the webhook).

Create the work item

Add a Create work item action and pick the project and work type. Set the fields from the cside payload:

Summary: {{webhookData.summary}}
Description: {{webhookData.description}}

Only set fields that are on the project’s create screen. Jira ignores the rest and reports them in the audit log.

Turn the rule on and copy the URL and secret

Save and turn on the rule. The trigger then shows a webhook URL and a secret. Copy both.

Add the webhook destination in cside

Build the URL

Add a slash and the secret to the end of the webhook URL:

https://api-private.atlassian.com/automation/webhooks/jira/a/<id>/<id>/<secret>

Add the destination

Open the dashboard and go to Team Settings > Notifications. Edit the notification config, click Add destination under Send To, select Webhook, and fill in:

URL: the URL from the previous step
Secret: any value. cside uses it to sign the request with an x-cside-signature header, which Jira does not check
Format: JSON

Click Save & Test.

Confirm it’s working

Save & Test sends a sample payload. For most triggers its summary starts with [Test]. Open the rule’s Audit log in Jira: you should see a new run and a created work item.

Jira answers with HTTP 200 when the secret is wrong, so a successful test in cside does not prove that the rule ran. The audit log is the confirmation.

What you see	What it means
cside test fails with HTTP 400	The secret is missing from the URL. Jira answers `Missing token`
cside test fails with HTTP 404	The URL is wrong, or the rule was deleted
cside test succeeds, but the audit log shows no run	The secret in the URL is wrong. Copy it again from the trigger
Audit log: Summary is required	The Summary field resolved to nothing. Use `{{webhookData.summary}}`
Audit log: Fields ignored	A field in the action is not on the create screen, or the automation user lacks the permission to set it. Remove the field from the action

Mapping other fields

Every cside JSON webhook carries summary and description both at the top level and inside its data object, because Jira Automation treats a top-level data key specially. That is why {{webhookData.summary}} works for every event. Other fields differ per event; see the payload reference.

To map more fields, add a Log action with {{webhookData}} before Create work item, send a test, and read the audit log to see exactly what Jira received. Reference the fields as they appear there.

Keep the secret safe

The secret is now part of the destination URL, so anyone who can view or edit your notification settings can read it. If it leaks, generate a new secret on the Jira trigger and update the URL in cside.

What this does not do yet

cside cannot send the X-Automation-Webhook-Token header, which Atlassian recommends over the URL form
cside does not retry a digest webhook that Jira rejects, and the delivery history is not shown in the dashboard. Use Save & Test and the Jira audit log to confirm the setup