Atlassian Jira

Overview

Target users: Security and audit staff and Jira administrators in organizations that use Atlassian Jira Cloud

With the Atlassian Jira app, you can do the following:

• Review changes to permissions, users and groups, projects, and field, screen, and workflow configurations, as well as issue deletions
• Track issue creation, field changes, and comment creation and updates
• Retrieve audit logs with the jira-audit-logs command without a logger

Key Concepts and Terms

Main Screens and Menu Paths

Task Scenarios

Scenario 1: Find Deleted Issues and Who Deleted Them

Purpose: When an issue is deleted, find which issue was deleted, by whom, and when. The audit log contains only the author account ID, so join it with the account information in the issue activity log to see the name and email.

Prerequisites:

• The audit log collection setup and the issue activity log collection setup in the install guide must be completed.
• The account that created the token must have the Administer Jira global permission.

Steps:

1. Run the following query in Analysis > Queries.

table duration=7d JIRA_AUDIT
| search summary == "Deleted Jira issue"
| fields _time, object_name, author_account_id, src_ip
| join type=left author_account_id [
    table duration=30d JIRA_ISSUE_ACTIVITY
    | sort limit=1 -_time by user
    | fields user, user_name, user_email
    | rename user as author_account_id ]
| sort -_time
| fields - author_account_id

2. To also see the author account ID, remove the last line (fields - author_account_id).

Expected results:

• object_name is the key of the deleted issue.
• src_ip may be empty because it is not always recorded.

Troubleshooting:

Scenario 2: View the Change History of a Specific Issue

Purpose: See in chronological order when and by whom the assignee, status, priority, and other fields of a specific issue were changed, and which comments were added.

Prerequisites:

• The issue activity log collection setup in the install guide must be completed.
• The account that created the token must be able to view the issues in the project.

Steps:

1. Decide the key of the issue to check. Example: PROJ-2
2. Run the following query in Analysis > Queries.

table duration=7d JIRA_ISSUE_ACTIVITY
| search issue_key == "PROJ-2"
| sort _time
| fields _time, action, user_name, changes, content

Expected results:

• In the table above, changes is shortened to "field: previous value → new value".
• For issue creation, content is the issue description. For comment creation and updates, content is the comment text.

Troubleshooting:

Notes

• Language of category values: The category in audit logs is translated according to the language setting of the account that created the token. In query conditions, it is safer to use summary, which is recorded in English.
• Audit log retention period: Jira keeps audit logs only for the retention period set by the site administrator (up to 6 months), so older records cannot be collected or retrieved.
• Visible scope: Issue activity is collected only for issues in projects that the account that created the token can view.
• Comment updates and deletions: Comment update events record only the edited content, and comment deletions are not collected. Issue deletions are recorded in audit logs, not in issue activity.
• jira-audit-logs and connect profiles: The command queries all registered Jira connect profiles, so if any profile has an invalid or expired token, the whole query fails.

Related Documents

• Install guide — API token creation, connect profile, and logger setup
• jira-audit-logs — Command for retrieving audit logs
• jira-audit — Audit log schema
• jira-issue-activity — Issue activity log schema