Creating Tickets for Failed Posture Checks

Prerequisites

• User with Browse spaces and Create work items permissions

Step 1: Configuring the Required Settings in Jira

To configure the settings in Jira:

1. In your Atlassian account, click on your profile in the top right corner and click Account settings.

2. On the Security tab, in the API tokens section, click Create and manage API tokens.

3. You can create an API token either with or without scopes:

   1. To create an API token with scopes:

      1. Click Create API token with scopes.

      2. Add a Name and expiry date.
         Note: We recommend selecting the maximum expiry date of 365 days.

      3. Click Next and select the Jira app

      4. Click Next and select the write:jira-work scope

      5. Click Create.

   2. To create an API token without scopes:

      1. Click Create API token.

      2. Add a Name and expiry date.
         Note: We recommend selecting the maximum expiry date of 365 days.

      3. Click Create.

4. Copy and save the token so it can be entered into the CMA.

5. In your Atlassian account, on the side bar, click the three dots next to Spaces.

6. Click Manage spaces.

7. Copy and save the Key of the space where you want the tickets to be created so it can be entered into the CMA.

8. If you created a token with scopes, in a web browser, enter https://<your-site>.atlassian.net/_edge/tenant_info and copy the cloudId value so it can be entered into the CMA.
   If you did not create a token with a scope, this step is not necessary.

Step 2: Configuring the Webhook in the CMA

To configure the webhook in the CMA:

1. In the CMA, navigate to Account > Subscriptions.

2. On the Webhooks tab, click New.

3. Add a Name.

4. From the Start from template drop-down menu, select Jira Create Posture Check Ticket.

5. In the URL field:

   1. For an API token with scopes: https://api.atlassian.com/ex/jira/<cloudId>/rest/api/2/issue, where <cloudId> is the cloudId that you copied in Step 1.

   2. For an API token without scopes: https://<your-site>.atlassian.net/rest/api/2/issue, where <your-site> is the name of your Jira site.

6. Add the User Name of the user that created the API token in step 1.

7. In the Password field, enter the API key you created in step 1.

8. In the Custom Body section, replace <YOUR-SPACE-KEY> with the space key that you copied in Step 1.

9. (Optional) If your space does not use the Task work type, or requires additional fields for new work items, edit the body accordingly.

10. Click Test.
    A test work item is created in the Jira space, and the message Test passed successfully is shown. You can delete the test work item afterwards.

11. Click Save.

Prerequisites

• User with the itil role

Step 1: Configuring the Required Settings in ServiceNow

To configure the settings in ServiceNow:

1. Log in to your ServiceNow account as an administrator and navigate to User Administration > Users.

2. Click New.

3. Enter a User ID and email address and select Web service access only.

4. Click Submit.

5. Open the record of the user you created:

   1. Click Set Password then Generate Password. Copy and save the password so it can be entered into the CMA.

   2. Click Save Password.  

   3. On the Roles tab, click Edit and add the itil role

   4. Click Save

Step 2: Configuring the Webhook in the CMA

To configure the webhook in the CMA:

1. In the CMA, navigate to Account > Subscriptions.

2. On the Webhooks tab, click New.

3. Add a Name.

4. From the Start from template drop-down menu, select ServiceNow Create Posture Check Ticket.

5. In the URL field, replace <YOUR-INSTANCE-NAME> with your ServiceNow instance name, so that the URL is https://<instance>.service-now.com/api/now/table/incident.

   Your instance name is the first part of your ServiceNow URL. For example, if you log in to https://acme.service-now.com, the instance name is acme, and the URL is https://acme.service-now.com/api/now/table/incident.

6. In the User Name field, enter the User ID of the ServiceNow user you created in Step 1.

7. In the Password field, enter the password of the ServiceNow user you created in Step 1.

8. (Optional) In the Custom Body section, change the default priority, urgency and impact of the incidents, or add fields such as assignment_group.

9. Click Test.
   A test incident is created in the ServiceNow, and the message Test passed successfully is shown. You can resolve or close the test work item afterwards.

10. Click Save.

If ticket creation fails, the error message shows the status returned by the ticketing system:

• 401 (Unauthorized): The credentials are incorrect, or the token has expired. Check the webhook’s User Name and Password fields, then click Test. For Jira, use the user’s email address and API token. If the token has expired, create a new token and update the webhook’s Password field.

• 403 (Forbidden): The user does not have the required permissions. For Jira, verify that the user has Browse spaces and Create work items permissions in the relevant space. For ServiceNow, verify that the user has the itil role.

• 400 (Bad Request): The ticketing system rejected the request body. Check for an incorrect space key or a missing required field in the Custom Body.

• Ticket ID missing: The ticket was created, but Cato could not read its ID from the response. Verify that the webhook’s response mapping matches the template.