Task trackers
Create tasks for findings in Jira or YouTrack and keep their statuses in sync.
A task tracker integration creates a task for each finding that your developers need to fix, and keeps the task and the finding in step: when the finding changes status, its task moves to the matching status in the tracker.
Portal supports Jira (Cloud, Data Center and Server) and YouTrack. Linear is shown as Coming soon.
Task trackers need a paid license. See License.
A task tracker has two parts:
- a connection holds the server URL and credentials;
- an integration on top of it says which project the tasks go to and how they are created.
Both are under Task Trackers in the settings, in the Integrations section.
Connect a tracker
Open Task Trackers, then Task Tracker Connections, and add a connection. Choose the Tracker type, enter a Name and the Server URL, then click Set credentials:
| Tracker | Credentials |
|---|---|
| Jira Cloud | Basic: your account email as the username and an Atlassian API token |
| Jira Data Center or Server | Token: a personal access token from your Jira profile, or OAuth through an incoming Application Link |
| YouTrack | Token: a permanent token from your account security settings |
The form links to the page where you create each one. To change the server URL later, use Replace credentials.
Add an integration
Open Task Tracker Integrations and add an integration on top of the connection. A global integration covers every product.
| Tab | Settings |
|---|---|
| General | Name, Project key, and Use this integration to turn it off without deleting it |
| Task Fields | Task type, Components, Default assignee, Push due date (a due date from the SLA: the time to resolve, or the time to assign and resolve), Mask findings description (leave the scanner’s description out of the task) |
| Settings | Automatically create tasks on finding verification; Delete tasks for rejected findings; When a task is resolved, mark it as done in other integrations too, for a finding with tasks in several trackers or projects |
| Status mappings | the tracker status a task moves to when its finding changes status |
| Priority mappings | the tracker priority a task gets for each finding severity |
| Sync from tracker | what changes in the tracker update the finding (see below) |
Save the project key first: the other fields load their values from the tracker.
Per product
A product uses the global integrations as they are. To change a setting for one product, open the product’s Options, then Task Trackers. There you can:
- override single settings, for example another project key or default assignee (Inherit again drops the override);
- force an integration on or off for the product;
- add an integration that only this product uses.
Create tasks
- Automatically: with Automatically create tasks on finding verification on, a task is created when a finding becomes Verified, by hand or by the Auto Validator. An Auto Validator rule can override this for the findings it verifies.
- For one finding: open the finding and create its task, or Attach existing to link a task that is already in the tracker.
- For many findings: select them in Findings and choose Create tasks.
Tasks are created in the background. A finding shows while its task is queued or being created, and Retry when it failed. When the outcome is unknown, check the tracker before retrying: the task may have been created anyway.
New comments on a finding are posted to its tasks too.
A finding group can have an epic in the tracker, with a task for each of its findings linked to the epic or only a list of findings in the epic.
Get updates back
Findings always send their changes to the tracker. To get changes back, open the connection’s Webhook tab, click Set up webhook and add the Webhook URL and Webhook token to the tracker:
- Jira: System → WebHooks, triggered by issue updated events of your project.
- YouTrack: turn on the Webhook Triggers app for the project, then use the URL for the issue updated and issue deleted events, with the header name and token shown in Portal.
The tracker must be able to reach the external Portal URL. Then choose what comes back on the integration’s Sync from tracker tab:
| Setting | Effect |
|---|---|
| Tracker statuses and priorities update the finding | moving a task to a mapped status or priority sets the finding’s status and severity |
| Assignee in the tracker moves the finding to Assigned | assigning the task moves its finding to Assigned; unassigning moves it back to Verified |
| Task name and labels update the finding | the task’s summary and labels replace the finding’s name and tags |
Delete
Deleting a connection deletes its integrations, and deleting an integration deletes its product overrides. Both remove the links between findings and tasks. You can choose to delete the tasks and epics in the tracker as well; otherwise they stay there.