Sonatype for Jira Data Center

Sunsetting Notice

• The Sonatype for Jira Data Center plugin entered Extended Maintenance on January 31, 2026 (no additional features; best‑effort support for critical bug fixes).
• The plugin will receive only critical bug and security fixes through December 31, 2026.
• On January 1, 2027, the plugin will be sunsetted, removed from the Atlassian Marketplace, and archived.

For details on what “Extended Maintenance” and “Sunsetted” mean, see Sonatype Sunsetting Information.

Sonatype for Jira Data Center is an Atlassian Jira plugin that automates the creation of Jira issues for new policy violations.

• Prioritize remediation of open-source policy violations from the Lifecycle server inside the Jira Data Center
• Automatically create Jira issues when new violations occur
• Transition project issues once they have been remediated in the application code

The Sonatype for Jira Data Center integration is available on the Atlassian Marketplace.

Workflow overview

1. The plugin is integrated by the Jira Administrator to communicate with the Lifecycle server
2. Jira Administrators associate projects with applications in Lifecycle
3. Administrators identify the policies to create Jira issues
4. Tickets are created for new violations in Jira projects
5. Remediated violations are updated in the corresponding tickets

Release Notes

iq-jira-plugin

Changelog

Version 3.0.1 (April 08, 2026) Anchor

• Updated internal dependencies to address a security vulnerability

Version 3.0.0 (September 03, 2025) Anchor

• Added support for Jira Data Center version 11

Version 2.2.0 (April 21, 2025) Anchor

• Added Developer Priorities URL to the generated issues’ description
• Added support for Jira 10.5.0

Version 2.1.0 (December 03, 2024) Anchor

• Added support in the user interface for deleting an existing project mapping
• Updated CVE/Sonatype IDs to be clickable links that direct users to the IQ Server Vulnerability Lookup page
• Implemented validation on the configuration page to prevent the creation of a webhook without a secret

Version 2.0.3 (September 30, 2024) Anchor

• Added support for Jira Data Center version 10

Version 2.0.2 (September 30, 2024) Anchor

• Added support for Jira Data Center version 10

Version 2.0.0 (September 27, 2024) Anchor

• Added support for Jira Data Center version 10

Version 1.11.0 (March 11, 2024) Anchor

• Re-worded the Sonatype plugin UI

Version 1.10.2 (February 8, 2024) Anchor

• The Sonatype plugin for Jira integration is now certified to be installed in Jira Data Center instances

Version 1.10.0 (February 2, 2024) Anchor

• The Sonatype plugin for Jira is now certified to be installed in Jira Data Center instances
• The minimum supported Jira version is now 8.20.0. Support for Jira 7.13.0 is no longer available

Version 1.9.1 (June 15, 2023) Anchor

• Minor bug fix to better handle cases when Jira project IDs change

Version 1.9.0 (November 23, 2022) Anchor

• This release offers improvements to the Jira workflow during automatic transition of tasks
• If an issue is about to be transitioned, but the transition cannot be performed, a comment is added to the issue describing why the transition is not performed (e.g. unmet constraints)
• The user set as reporter of the Jira issues, during Lifecycle Mapping, will now appear as commenter on the tickets, instead of the project owner or admin

Version 1.8.1 (July 29, 2022) Anchor

• Plugin usage telemetry is collected and sent to Lifecycle

Version 1.8.0 (July 15, 2022) Anchor

• The Sonatype plugin for Jira is compatible with Jira version 9
• Plugin configuration telemetry is collected and sent to Lifecycle

Version 1.7.1 (June 16, 2022) Anchor

• Prevent a potential NPE to happen

Version 1.7.0 (March 23, 2022) Anchor

• Cleaning project mappings on project deleted event
• Improving error logging
• Setting default security level for issues

Version 1.6.0 (September 28, 2020) Anchor

• Automatically apply workflow transition when all policy violations are remediated
• Bug fixes and improvements.

Compatibility

iq-jira-plugin

Compatibility

Requirements

• Sonatype Lifecycle license and configured IQ Server
• IQ Server account with the Policy Administrator role
• Jira Administrator account to install and configure the plugin

For details on the Jira Data Center versions supported, please check the plugin's Atlassian Marketplace listing.

Note
The Sonatype for Jira plugin is verified by Sonatype to work on the Jira Data Center

Installation

The initial installation is only required once and will apply to all Jira projects. This configuration enables the integration between Jira and Sonatype IQ Server.

• Install the Sonatype for Jira Data Center from the Atlassian Marketplace

Important
When migrated from Jira Server to Jira Data Center from version 1.10.2 or previous versions, uninstall the previous plugin and re-install a data center-compatible version. The server-compatible plugin versions cannot be automatically upgraded to data center-compatible versions.

Configure the plugin

Configuration of the Sonatype for Jira Data Center plugin is done at the global Jira instance level.

1. In Jira, navigate to the settings icon.
2. Click Applications.
3. Under Integrations, click Sonatype for Jira.
4. Enter the Sonatype for Jira Configuration parameters.
5. Click Save.
6. Click Test to confirm connection to the Lifecycle server.
7. Click Create webhook to add a webhook.

Manually configuring the Lifecycle server webhook

Manually configure a webhook using these configure webhook steps

• The Violation Alert event type is required
• Use the same secret key in both the webhook and IQ configuration

Jira project to Lifecycle server associations

Sonatype Lifecycle organizations/applications are associated with a specific Jira project. Follow the steps below for each Jira project intended to receive policy violation notifications from the Sonatype IQ Server.

Configure mapping between a Jira project and an organization and/or application within the Lifecycle server

1. Navigate to the desired project in Jira.
2. Click on the Project Settings gear icon in the lower left of your screen.
3. Click on the Sonatype menu option. If the page is empty after clicking the link, sign into Jira with a user with Administer Project permissions for the project.

A Jira project can be mapped to one or more Lifecycle organizations or applications. When new violations occurs, new issues are created.

• One or more applications or organizations are required to trigger the creation of policy violation tickets
• Default fields (e.g. the 'Reporter' field in the screenshot below) appear at the bottom of the page
• A custom field must be marked as required in Jira to be displayed on this form

Automate Workflow Transition

Sonatype for Jira will attempt to apply the selected Workflow Transition to issues when policy violations are successfully remediated.

• The selected transition must be valid for the current ticket state.
• Workflow requirements must be met (for example: required fields).
• A comment is created on the issue linking to the Lifecycle scan report.
• Errors are logged with an entry on the reason for failure.

Configure Notifications to Jira

The Jira notification creates a Jira issue when new policy violations are discovered. To create Jira notifications, install the Jira plugin and configure its communication with the Lifecycle server via a webhook (see above). To configure Jira notifications:

1. Select the policy for which notifications will be created upon its violation.
2. Click Webhook from the Recipient Type option.
3. Select the appropriate Webhook from the Select Webhook option.
4. Select Add.
5. Specify the stages to create notifications.

Review violation tickets within the plugin

When Lifecycle detects violations, new issues are created on the project board with the New status. Example of issue aggregation of By IQ Evaluation

A subtask is created for each of the components attached to the primary report scan ticket for the issue aggregation of By Component

The following fields are populated as follows:

• Type: Corresponds to the selected issue type on the mapping page.
• Labels: Corresponds to a selected label on the mapping page.
• Reporter: Corresponds to a selected reporter on the mapping page.
• Priority: Lifecycle threat level 10 is mapped to the highest Jira priority with the threat of 0 is mapped to the lowest priority. Additional priorities are assigned using a linear function.

Note
Priority names for your organization can be different if they've been customized in Jira settings by a Jira admin.

Supported and unsupported field types

Default values are required for mandatory fields in Jira. The plugin will ignore the unsupported fields if they are marked optional in Jira. The supported fields are: Number, Paragraph, Short text, Select list (single choice), Select list (multiple choices), URL, Radio, Labels

Supported Custom Field Types

• Date Picker
• Date Time Picker
• Labels
• Number Field
• Paragraph Field
• Short Text
• URL Field
• User Picker

Jira Integration troubleshooting tips

• Check that policy notifications are sent to the Jira webhook.
• Jira issues are only created for new violations.
• No Action is taken when the violation has already been sent to Jira.
• Verify the webhook URL matches between the Lifecycle server and Jira.
• Check the Sonatype for Jira Cloud configuration page on Jira for error messages. The message box will display the status of the last webhook received from the Lifecycle server.
• At least one application or organization needs to be mapped to the project.
• Check that the violation alerts are mapped to the correct Jira project.
• Check that the evaluation stage matches the configured webhook notification.

Jira logging

Error messages are sent to Jira's default log4j logger of levels WARN or higher. Log levels can be temporarily changed by navigating to the System → Logging and Profiling tab on the Jira administration page. To make log changes permanent or for advanced log4j settings, edit 'WEB-INF/classes/log4j.properties'. The logging of the Jira plugin can be customized using the following log levels: