---
title: "Task trackers"
description: "Create tasks for findings in Jira or YouTrack and keep their statuses in sync."
url: https://whitespots.io/docs/appsec-portal/integrations/task-trackers
slug: appsec-portal/integrations/task-trackers
publish_date: 2026-10-30T19:42:15.000Z
last_modified: 2026-10-30T19:42:15.000Z
---

# Task trackers

A task tracker integration creates a task for each finding that your developers need to fix, and
keeps the task and the finding in step: when the finding changes status, its task moves to the
matching status in the tracker.

Portal supports Jira (Cloud, Data Center and Server) and YouTrack. Linear is
shown as **Coming soon**.

Task trackers need a paid license. See [License](https://whitespots.io/docs/appsec-portal/administration/license).

A task tracker has two parts:

- a **connection** holds the server URL and credentials;
- an **integration** on top of it says which project the tasks go to and how they are created.

Both are under **Task Trackers** in the settings, in the **Integrations** section.

## Connect a tracker

Open **Task Trackers**, then **Task Tracker Connections**, and add a connection. Choose the
**Tracker type**, enter a **Name** and the **Server URL**, then click **Set credentials**:

| Tracker | Credentials |
| --- | --- |
| Jira Cloud | **Basic**: your account email as the username and an Atlassian API token |
| Jira Data Center or Server | **Token**: a personal access token from your Jira profile, or **OAuth** through an incoming Application Link |
| YouTrack | **Token**: a permanent token from your account security settings |

The form links to the page where you create each one. To change the server URL later, use
**Replace credentials**.

## Add an integration

Open **Task Tracker Integrations** and add an integration on top of the connection. A global
integration covers every product.

| Tab | Settings |
| --- | --- |
| **General** | **Name**, **Project key**, and **Use this integration** to turn it off without deleting it |
| **Task Fields** | **Task type**, **Components**, **Default assignee**, **Push due date** (a due date from the [SLA](https://whitespots.io/docs/appsec-portal/track-risk/sla): the time to resolve, or the time to assign and resolve), **Mask findings description** (leave the scanner's description out of the task) |
| **Settings** | **Automatically create tasks on finding verification**; **Delete tasks for rejected findings**; **When a task is resolved, mark it as done in other integrations too**, for a finding with tasks in several trackers or projects |
| **Status mappings** | the tracker status a task moves to when its finding changes status |
| **Priority mappings** | the tracker priority a task gets for each finding severity |
| **Sync from tracker** | what changes in the tracker update the finding (see below) |

Save the project key first: the other fields load their values from the tracker.

### Per product

A product uses the global integrations as they are. To change a setting for one product, open the
product's **Options**, then **Task Trackers**. There you can:

- override single settings, for example another project key or default assignee
  (**Inherit again** drops the override);
- force an integration on or off for the product;
- add an integration that only this product uses.

## Create tasks

- **Automatically**: with **Automatically create tasks on finding verification** on, a task is
  created when a finding becomes Verified, by hand or by the
  [Auto Validator](https://whitespots.io/docs/appsec-portal/triage-findings/automate-triage/auto-validator). An Auto Validator rule
  can override this for the findings it verifies.
- **For one finding**: open the finding and create its task, or **Attach existing** to link a
  task that is already in the tracker.
- **For many findings**: select them in [Findings](https://whitespots.io/docs/appsec-portal/triage-findings/findings) and choose
  **Create tasks**.

Tasks are created in the background. A finding shows while its task is queued or being created, and
**Retry** when it failed. When the outcome is unknown, check the tracker before retrying: the task
may have been created anyway.

New comments on a finding are posted to its tasks too.

A [finding group](https://whitespots.io/docs/appsec-portal/triage-findings/finding-groups) can have an epic in the tracker, with a
task for each of its findings linked to the epic or only a list of findings in the epic.

## Get updates back

Findings always send their changes to the tracker. To get changes back, open the connection's
**Webhook** tab, click **Set up webhook** and add the **Webhook URL** and **Webhook token** to the
tracker:

- **Jira**: **System** → **WebHooks**, triggered by issue updated events of your project.
- **YouTrack**: turn on the Webhook Triggers app for the project, then use the URL for the issue
  updated and issue deleted events, with the header name and token shown in Portal.

The tracker must be able to reach the external Portal URL. Then choose what
comes back on the integration's **Sync from tracker** tab:

| Setting | Effect |
| --- | --- |
| **Tracker statuses and priorities update the finding** | moving a task to a mapped status or priority sets the finding's status and severity |
| **Assignee in the tracker moves the finding to Assigned** | assigning the task moves its finding to **Assigned**; unassigning moves it back to **Verified** |
| **Task name and labels update the finding** | the task's summary and labels replace the finding's name and tags |

## Delete

Deleting a connection deletes its integrations, and deleting an integration deletes its product
overrides. Both remove the links between findings and tasks. You can choose to delete the tasks
and epics in the tracker as well; otherwise they stay there.

---

## Navigation

- Location: [Docs](https://whitespots.io/docs) > [Application Security Portal](https://whitespots.io/docs/appsec-portal) > [Integrations](https://whitespots.io/docs/appsec-portal/integrations)
- Previous: [Container registries](https://whitespots.io/docs/appsec-portal/integrations/container-registries)
- Next: [Notifications](https://whitespots.io/docs/appsec-portal/integrations/notifications)