You can use Datadog Case Management to manage tickets in third-party tools like Jira. For details, see Case Management integration with third-party ticketing tools.

This page discusses using Datadog Security with Datadog Case Management for ticketing management.

Case management and security products

Case Management is supported for all security products that use signals or findings:

• Code Security (in Findings)
• Cloud Security (in Findings)
• Cloud SIEM (in Signals)
• App and API Protection (in Signals and Findings)
• Workload Protection (in Signals and Findings)

Open any signal or finding in these products or do a bulk selection of findings in the explorers, and use the Create Ticket button to create a case in Datadog.

Bidirectional ticket syncing with Jira

Bidirectional syncing enables you to update Jira tickets automatically when changes occur in Datadog, and update some Datadog information when changes occur in Jira.

Supported products

Bidirectional syncing is supported for the following Code and Cloud Security finding categories:

• Libraries (SCA)
• Static Code (SAST)
• Runtime Code (IAST)
• Secret Scanning (SDS)
• Infrastructure as Code (IaC)
• Misconfigurations
• Identity Risks
• Host and Container Vulnerabilities
• App and API Protection
• Workload Protection

Single source of truth

Bidirectional syncing with Jira enables you to sync Jira tickets with Datadog cases. However, Datadog is the single source of truth for issue detection and resolution.

A Datadog finding’s related Jira ticket can be closed manually. However, the Datadog finding remains open if Datadog cannot confirm that the issue is fixed. This restriction ensures that a finding is not closed and removed when someone closes a related Jira ticket.

Closing a Datadog case without remediation does not close the finding either.

Remediation of the finding in Datadog or defining an exception by muting the finding are the only ways to close a finding. After the finding is remediated, its related cases and Jira tickets are closed.

Set up bidirectional syncing

The following steps set up bidirectional syncing with Jira and verify that setup is successful.

1. Set up the following prerequisites in your Datadog account, or verify that they are set up already. The prerequisites are listed in their setup order.
   1. The Datadog Jira integration.
   2. A webhook for the Jira integration. Configuring a webhook enables cases created in Case Management to automatically create issues in Jira and keep both resources synced.
   3. A new Case Management project. A project is a container object that holds a set of cases.
   4. The Jira integration is configured within the project.
      1. Enable the Sync data between Case Management and Jira option.
      2. In Title, select Two-way sync.
      3. Complete the remaining settings, and then click Save changes.
2. Verify that bidirectional Case Management integration with Jira is working:
   1. Open any product supporting bidirectional ticket syncing.
   2. Open any Security finding.
   3. Locate the Create Ticket option. The option is available in Next Steps or Repositories (in Libraries (SCA)). The button opens a Create Ticket modal.
   4. Click the Jira tab.
   5. Verify that the Case Management <-> Jira Integration section exists and bidirectional sync is enabled.

You are ready to start creating bidirectional Case Management tickets.

If you do not see the Case Management <-> Jira Integration section, ensure that you have completed the prerequisites.

Create bidirectional tickets

The following steps create a bidirectional ticket for a Security finding.

1. Open any product supporting bidirectional ticket syncing.
2. Open any Security finding.
3. Locate the Create Ticket option. The option is available in Next Steps or Repositories (in Libraries (SCA)). The button opens a Create Ticket modal.
4. Create ticket for any third-party tool supported (see sections below)

Manage bidirectional Case Management tickets

Existing bidirectional Jira tickets are listed in the finding’s Ticketing or Next Steps sections.

Here’s an example from a Static Code (SAST) finding:

Hover over the Jira ticket to see its details.

Details such as assignee and status are provided along with a timeline of the Jira issue and Datadog case changes.

Closed Jira tickets are green.

In Datadog Associated Case, the related Datadog case is provided. Click the case name to open it in Case Management.

Automatic detachment and ticket opening/closing

Archiving a case does not delete related Jira tickets, but deleting a case project detaches all tickets from related Security findings.

Detaching a ticket from a Security finding does not delete it.

If there are no open findings left attached to a ticket (because they are all detached or resolved or muted), it is automatically closed. Similarly, if at least one open finding is attached to a closed ticket (because it was attached or detected again or unmuted), it is automatically reopened.

Bidirectional Case Management facets

There are several case management facets under Triage, including:

• Case Key
• Jira Key
• Case Status
• Has ticket attached

You can query attributes and create dashboards using these facets.

Ticketing integration API

The link between Datadog Cases and existing Security findings can be managed with the public API.

Dedicated endpoints allow users to create Datadog case for existing security findings, attach security findings to an existing Datadog case, and detach security findings from their case.

Users can also create Jira issues for security findings and attach security findings to a Jira issue.