# Jira ITSM

<figure><img src="https://762006384-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MJXOXEifAmpyvNVL1to%2Fuploads%2Fc0nsYJHJb0JB2OrCj5VT%2Fkeeper%2Bjira.png?alt=media&#x26;token=4ac6094c-ee78-4430-ae35-0a9a856f8e71" alt=""><figcaption></figcaption></figure>

## About

The **Keeper Security ITSM Integration** is a Forge-based application that automatically converts security alerts from Keeper Security into actionable Jira tickets. The integration enables security teams, IT administrators, and compliance officers to respond to security incidents immediately without manual ticket creation, ensuring no alert goes unnoticed and maintaining complete audit trails for compliance requirements.

## Features

* **Automated Ticket Creation:** Receive security alerts from Keeper via webhooks and automatically create Jira issues with complete alert details including raw JSON payloads for full audit trails.
* **Flexible Field Mapping:** Map Keeper alert fields (`alert_name`, `description`, `audit_event`, `username`, `remote_address`, `timestamp`, etc.) to any Jira field including standard fields and custom fields.
* **Priority Mapping:** Automatically assign Jira priorities based on Keeper event categories (e.g., data breaches → Highest, routine audits → Low).
* **Default Issue Type Selection:** Configure a default Jira issue type (Epic, Story, Task, Bug, etc.) for all incoming Keeper alerts. Issue types are automatically populated based on the selected project.
* **Cross-Project Support:** Works with both Team-Managed and Company-Managed Jira projects for maximum flexibility.
* **Development Tools:** Built-in test functionality to verify webhook configuration and ticket creation before going live.
* **Webhook Authentication:** Secure your webhook endpoint with Bearer token authentication. Generate, regenerate, or revoke tokens directly from the admin interface to prevent unauthorized access.

## Prerequisites

* **Keeper Security Account**
  * **Subscription:** Keeper Enterprise or KeeperPAM subscription with ARAM (Advanced Reporting & Alerts)
  * **Admin Access:** Access to Keeper Security admin console for webhook configuration.
  * **Familiarity:** Understanding of Keeper alert types and event categories
* **Jira Cloud Instance**
  * **Platform:** Jira Cloud account
  * **Permissions**: Project administrator or Jira administrator permissions
  * **Projects**: At least one Jira project with appropriate issue types configured

## Supported Platform <a href="#configuring-discovery-credentials" id="configuring-discovery-credentials"></a>

The integration runs on Atlassian Forge platform and supports:

### Jira Cloud

| Aspect            | Support                                    |
| ----------------- | ------------------------------------------ |
| **Plans**         | Free, Standard, Premium, Enterprise        |
| **Project Types** | Team-Managed and Company-Managed           |
| **Regions**       | All Atlassian Cloud regions (US, EU, APAC) |

### Supported Browsers

| Platform    | Browsers                                      |
| ----------- | --------------------------------------------- |
| **Desktop** | Chrome 90+, Firefox 88+, Safari 14+, Edge 90+ |
| **Mobile**  | iOS Safari 14+, Chrome Mobile 90+             |

## Requirements

### Jira Requirements

| Requirement       | Details                                        |
| ----------------- | ---------------------------------------------- |
| **Jira Cloud**    | Any plan (Free, Standard, Premium, Enterprise) |
| **API Access**    | REST API v3 enabled (default)                  |
| **Custom Fields** | Available on Standard plan and above           |

### Keeper Security Requirements

| Requirement         | Details                            |
| ------------------- | ---------------------------------- |
| **Enterprise Plan** | Required for webhook functionality |
| **Admin Access**    | Required for webhook configuration |
| **Alert Types**     | At least one configured alert type |

## Installation <a href="#configuring-discovery-credentials" id="configuring-discovery-credentials"></a>

#### Step 1: Navigate to Marketplace

Go to <https://marketplace.atlassian.com/2082843324>

#### Step 2: Install the App

1. Click **"Get it now"** or **"Try it free"**
2. Select your Jira site from the dropdown
3. Click **"Install app"**
4. Wait for installation to complete (30-60 seconds)

#### Step 3: Grant Permissions

The app requests these permissions:

| Permission        | Purpose                  |
| ----------------- | ------------------------ |
| `read:jira-work`  | Read issues and projects |
| `write:jira-work` | Create and update issues |
| `read:jira-user`  | Read user information    |
| `storage:app`     | Store configuration data |

Click **"Accept"** to grant permissions.

#### Step 4: Verify Installation

1. Go to **Jira Settings (⚙️)**
2. Click **"Apps" → "Manage apps"**
3. Verify **"Keeper Security ITSM"** appears in the installed apps list

<figure><img src="https://762006384-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MJXOXEifAmpyvNVL1to%2Fuploads%2Fd3mdh8pbnAE32bkzRdKa%2FScreenshot%202026-01-02%20at%208.51.24%E2%80%AFAM.png?alt=media&#x26;token=3c47d298-7460-4ae3-a09a-d937a5e9a3d6" alt=""><figcaption></figcaption></figure>

## Authentication

The integration uses Forge's built-in authentication system. No additional authentication configuration is required.

{% tabs %}
{% tab title="Project Admins" %}

1. Navigate to **Settings (⚙️) → Apps → Keeper Security ITSM**
2. If prompted, click "Allow access" to grant permissions
   {% endtab %}

{% tab title="Production Deployment" %}

1. Global admin must access the app first to grant site-wide consent
2. After consent, all project admins can access without additional authorization
   {% endtab %}
   {% endtabs %}

## Configuration

#### Step 1: Access the Admin Interface

1. Open your Jira instance
2. Navigate to **Settings (⚙️) → Apps**
3. Click **"Keeper Security ITSM"** in the sidebar
4. The interface loads with two main tabs:
   * **Web Trigger Setup**
   * **Advanced Configuration**

#### Step 2: Configure Target Project

**Select Target Project**

1. Click **"Web Trigger Setup"** tab
2. Click the **"Target Project"** dropdown
3. Select the Jira project where tickets should be created
   * Example: "SEC - Security Operations"

**Select Default Issue Type**

1. After selecting a project, the "**Default Issue Type**" dropdown automatically populates with issue types available in that project
2. Choose the issue type for all incoming Keeper alerts
   * Recommended: "Task" or "Incident"
   * Note: Subtask types are excluded as they require a parent issue

**Save Configuration**

1. Click **"Save Configuration"** button
2. Wait for success notification
3. All Keeper alerts will now create tickets with the selected issue type

<figure><img src="https://762006384-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MJXOXEifAmpyvNVL1to%2Fuploads%2FZb9v9XbzkWsNrj2CX8EX%2FScreenshot%202026-01-02%20at%208.54.16%E2%80%AFAM.png?alt=media&#x26;token=fac8068b-9ff7-41b1-9d6f-9c91b25b0e11" alt=""><figcaption></figcaption></figure>

#### Step 3: Configure Webhook

**Copy Webhook URL**

1. The Web Trigger URL appears below the save button
   * Format: `https://[your-site].atlassian.net/.../keeper-webhook`
2. Click the copy icon or manually select and copy
3. **Save this URL** for Keeper configuration

{% hint style="info" %}
**Keep this URL secure** — Anyone with this URL can create tickets in your Jira project.
{% endhint %}

**Configure Webhook Authentication (Recommended)**

Secure your webhook endpoint with Bearer token authentication to prevent unauthorized access.

**Generate Authentication Token**

1. In the **"Webhook Authentication"** section, check the status badge:
   * **"NOT CONFIGURED"** (yellow) - No token set, webhook is open
   * **"ENABLED"** (green) - Token authentication active
2. Click **"Generate Token"** button
3. **Copy the token immediately** - it will only be shown once
4. Store the token securely for Keeper configuration

**Token Management**

| Action               | Description                                     |
| -------------------- | ----------------------------------------------- |
| **Generate Token**   | Creates a new 64-character secure token         |
| **Regenerate Token** | Invalidates old token and creates new one       |
| **Revoke Token**     | Disables authentication (requires confirmation) |

{% hint style="warning" %}
**Security Warning:** Without a token, your webhook URL is accessible to anyone who has it. Always generate a token for production use.
{% endhint %}

<div><figure><img src="https://762006384-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MJXOXEifAmpyvNVL1to%2Fuploads%2FWpJLpDncVFIjWE1uZdxJ%2FScreenshot%202026-01-28%20at%202.07.42%E2%80%AFPM.png?alt=media&#x26;token=192e36d4-7f49-4d4c-9a41-7980a75f0874" alt=""><figcaption><p>Token not configured</p></figcaption></figure> <figure><img src="https://762006384-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MJXOXEifAmpyvNVL1to%2Fuploads%2FQc19CPDIKmuhaSqNLAKT%2FScreenshot%202026-01-28%20at%202.08.33%E2%80%AFPM.png?alt=media&#x26;token=0a389c6b-5dfc-4baa-bd6c-61e5bb327059" alt=""><figcaption><p>Token enabled</p></figcaption></figure></div>

<figure><img src="https://762006384-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MJXOXEifAmpyvNVL1to%2Fuploads%2F6okmaO1ML2fUSkUahEGY%2FScreenshot%202026-01-23%20at%202.13.16%E2%80%AFPM.png?alt=media&#x26;token=cb1d941b-9601-43d9-ac2e-9a2338e555d2" alt=""><figcaption></figcaption></figure>

#### Step 4: Configure Keeper Security Webhooks

1. Log in to your **Keeper Admin Console**
2. Navigate to **Reporting & Alerts**
3. Go to **Alerts** **→ Add Alert** **→ Select Alerts (example: BreachWatch Detection)**
4. Go to **Alerts → Add Alert → Add Recipient**
5. Enter Details:
   * **Name:** "Keeper ITSM Alerts" (this will appear in the Jira ticket title)
   * **Webhook URL:** Paste the URL from Jira app
   * **Token:** Paste token generated from Jira app
   * **HTTP Body**: Leave empty
   * **Save** webhook configuration

<figure><img src="https://762006384-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MJXOXEifAmpyvNVL1to%2Fuploads%2Fera9mLjJ428N5B79RhRM%2FScreenshot%202026-01-02%20at%208.56.32%E2%80%AFAM.png?alt=media&#x26;token=55af5003-e052-4c5b-8864-bee1bc632323" alt=""><figcaption><p>Select Events</p></figcaption></figure>

<figure><img src="https://762006384-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MJXOXEifAmpyvNVL1to%2Fuploads%2FYy3rrZ7gf5FC2R1khfyO%2FScreenshot%202026-01-02%20at%208.57.50%E2%80%AFAM.png?alt=media&#x26;token=75c83e79-ba46-466f-922a-04d2796cc8d2" alt=""><figcaption><p>Webhook Configuration</p></figcaption></figure>

#### Step 5: Test the Connection

Before receiving live alerts, test the integration:

**Option 1: Using Built-in Test Button**

1. In the Keeper ITSM app, scroll to **"Development Tools"** section
2. Click **"Test Web Trigger"** button
3. Verify success notification appears
4. Go to your Jira project board
5. Confirm a test ticket was created (e.g., "OPS-1: Security Alert: Test Event")

**Note:** The test button bypasses token authentication (internal call). Use Option 2 to test authentication end-to-end.

**Option 2: Using curl Command**

Test your webhook with authentication using curl:

**With Authentication Token:**

{% code overflow="wrap" %}

```
curl -X POST "https://YOUR-SITE.atlassian.net/x/YOUR-WEBHOOK-PATH"
-H "Content-Type: application/json"
-H "Authorization: Bearer YOUR-64-CHARACTER-TOKEN"
-d '{ "alert_name": "Test Alert", "description": "This is a test alert from curl", "audit_event": "test_event", "username": "test@example.com", "remote_address": "127.0.0.1", "timestamp": "2026-01-23T12:00:00.000Z" }'
```

{% endcode %}

{% hint style="success" %}
**Test Successful?** — Your integration is ready to receive live alerts from Keeper Security.
{% endhint %}

## Usage

#### Basic Workflow

The integration follows this automated workflow:

<p align="center"><strong>Keeper Security Alert → Webhook + Auth Token → Forge App → Jira Ticket Created</strong></p>

When Keeper Security detects any configured event (failed login, BreachWatch alert, etc.):

1. Keeper sends alert data via webhook with Authorization header
2. Forge app validates the Bearer token (if configured)
3. App validates and processes the payload
4. App maps fields and determines issue type/priority
5. Jira ticket created automatically with all alert details
6. Team receives notification and can respond immediately

<figure><img src="https://762006384-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MJXOXEifAmpyvNVL1to%2Fuploads%2FaUr3Dh2CFszoPJJcGb7b%2FScreenshot%202026-01-02%20at%209.12.54%E2%80%AFAM.png?alt=media&#x26;token=34af96c4-3900-44ed-a6bd-9b8132ee5431" alt=""><figcaption><p>Example Jira Ticket generated by Keeper ITSM Integration</p></figcaption></figure>

#### Creating Custom Fields

Custom fields capture Keeper-specific data that doesn't fit standard Jira fields.

**Recommended Custom Fields**

<table><thead><tr><th>Field Name</th><th width="130.171875">Type</th><th>Purpose</th><th>Example Value</th></tr></thead><tbody><tr><td>Remote IP Address</td><td>Text</td><td>Source IP of event</td><td><code>192.168.1.100</code></td></tr><tr><td>Event Category</td><td>Select List</td><td>Keeper alert category</td><td><code>security</code>, <code>audit</code>, <code>breach</code></td></tr><tr><td>Security Event Type</td><td>Text</td><td>Specific event type</td><td><code>audit_user_failed_login</code></td></tr><tr><td>Device Name</td><td>Text</td><td>Device that triggered alert</td><td><code>John-MacBook-Pro</code></td></tr><tr><td>Alert Timestamp</td><td>Date Time</td><td>Original alert time</td><td><code>2025-01-15T14:30:00Z</code></td></tr><tr><td>Alert Severity</td><td>Select List</td><td>Severity level</td><td><code>critical</code>, <code>high</code>, <code>medium</code>, <code>low</code></td></tr></tbody></table>

**Creating Custom Fields in Jira**

To set up custom fields, open the Keeper Security ITSM application and select the "Advanced Configuration" screen.

<figure><img src="https://762006384-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MJXOXEifAmpyvNVL1to%2Fuploads%2FRlYyBWulwgNrmeo88zzq%2FScreenshot%202026-01-02%20at%209.15.29%E2%80%AFAM.png?alt=media&#x26;token=76909b55-99df-49c3-81db-e43eb00a0054" alt=""><figcaption></figcaption></figure>

<table><thead><tr><th width="180.81640625">Step</th><th>Action</th><th>Details</th></tr></thead><tbody><tr><td><strong>1. Navigate</strong></td><td>Settings (⚙️) → Issues → Custom fields</td><td>Opens custom field management</td></tr><tr><td><strong>2. Create</strong></td><td>Click "Create custom field"</td><td>Choose field type (Text, Date, Select List, URL)</td></tr><tr><td><strong>3. Configure</strong></td><td>Enter name, description, options</td><td>Example: "Remote IP Address"</td></tr><tr><td><strong>4. Associate</strong></td><td>Link to projects and issue types</td><td>Select your target project</td></tr><tr><td><strong>5. Verify</strong></td><td>Create test issue to confirm field appears</td><td>Field ready for mapping</td></tr></tbody></table>

{% hint style="info" %}
**Note:** Custom fields require **Jira Administrator** permissions for global fields, or **Project Administrator** for project-specific fields.
{% endhint %}

#### Field Mapping Configuration

Map Keeper alert data to Jira fields for automatic population.

**Access Field Mapping**

1. Go to **Advanced Configuration** tab
2. Click **"Field Mapping"** sub-tab
3. View list of Keeper payload fields

**Example Mapping Configuration**

<table><thead><tr><th width="207.9296875">Keeper Field</th><th width="128.35546875" align="center">Maps To →</th><th>Jira Field</th></tr></thead><tbody><tr><td><code>alert_name</code></td><td align="center">→</td><td><strong>Summary</strong></td></tr><tr><td><code>description</code></td><td align="center">→</td><td><strong>Description</strong></td></tr><tr><td><code>audit_event</code></td><td align="center">→</td><td><strong>Security Event Type</strong> (custom)</td></tr><tr><td><code>username</code></td><td align="center">→</td><td><strong>Reporter</strong> or custom field</td></tr><tr><td><code>remote_address</code></td><td align="center">→</td><td><strong>Remote IP Address</strong> (custom)</td></tr><tr><td><code>timestamp</code></td><td align="center">→</td><td><strong>Alert Timestamp</strong> (custom)</td></tr></tbody></table>

**Steps to Configure**

1. Locate the Keeper field in the list
2. Click the dropdown next to the field
3. Select destination Jira field (standard or custom)
4. Click **"Save Mappings"** after configuration

#### Priority Mapping

Configure automatic priority assignment based on Keeper event categories.

1. Click **"Priority Mapping"** tab
2. Map event categories to priorities:

<table><thead><tr><th>Event Category</th><th width="183.62109375" align="center">Maps To →</th><th>Jira Priority</th></tr></thead><tbody><tr><td><code>data_breach</code></td><td align="center">→</td><td>Highest</td></tr><tr><td><code>password_breach</code></td><td align="center">→</td><td>Highest</td></tr><tr><td><code>unauthorized_access</code></td><td align="center">→</td><td>High</td></tr><tr><td><code>suspicious_activity</code></td><td align="center">→</td><td>High</td></tr><tr><td><code>policy_violation</code></td><td align="center">→</td><td>Medium</td></tr><tr><td><code>audit_user_login</code></td><td align="center">→</td><td>Low</td></tr></tbody></table>

3. Click **"Save Priority Mappings"**

<table><thead><tr><th width="258.609375">Event Category</th><th align="center">Maps To →</th><th>Jira Issue Type</th></tr></thead><tbody><tr><td><code>data_breach</code></td><td align="center">→</td><td>Incident</td></tr><tr><td><code>password_breach</code></td><td align="center">→</td><td>Incident</td></tr><tr><td><code>policy_violation</code></td><td align="center">→</td><td>Task</td></tr><tr><td><code>audit_user_login</code></td><td align="center">→</td><td>Sub-task</td></tr></tbody></table>

## Complete Workflow Example

#### Scenario: Audit Alert Resumed → Automated Jira Ticket

**Workflow Overview**

<table><thead><tr><th width="212.11328125">Phase</th><th width="291.328125">What Happens</th><th>Result</th></tr></thead><tbody><tr><td><strong>1. Setup (One-Time)</strong></td><td>Configure field/priority/issue mappings in app</td><td>Ready to receive alerts</td></tr><tr><td><strong>2. Alert Triggers</strong></td><td>Keeper detects admin resumed audit alert</td><td>Alert generated</td></tr><tr><td><strong>3. Webhook Sent</strong></td><td>Keeper sends alert data with Authorization header to webhook URL</td><td>Data transmitted securely</td></tr><tr><td><strong>4. Auth Validated</strong></td><td>App validates Bearer token (if configured)</td><td>Request authenticated</td></tr><tr><td><strong>5. App Processes</strong></td><td>App validates payload, maps fields, applies priority mapping</td><td>Ticket prepared</td></tr><tr><td><strong>6. Ticket Created</strong></td><td>Jira ticket auto-created with all alert details</td><td>Team notified</td></tr><tr><td><strong>7. Team Responds</strong></td><td>Operations team reviews and resolves</td><td>Incident closed</td></tr></tbody></table>

**Example Alert Flow**

**Keeper Alert Data:**

{% code overflow="wrap" %}

```javascript
{ 
    "alert_name": "Jira Alerts", 
    "description": "Admin john.doe@company.com resumed audit alert",
    "audit_event": "audit_alert_resumed",
    "username": "john.doe@company.com",
    "remote_address": "110.227.52.162",
    "timestamp": "2025-11-05T05:00:28.091Z"
}
```

{% endcode %}

**Jira Ticket Created (OPS-3346):**

<table><thead><tr><th width="210.20703125">Field</th><th>Value</th><th>Source</th></tr></thead><tbody><tr><td><strong>Type</strong></td><td>Task</td><td>Default issue type</td></tr><tr><td><strong>Summary</strong></td><td>Jira Alerts: audit_alert_resumed</td><td>From <code>alert_name</code> + <code>audit_event</code></td></tr><tr><td><strong>Description</strong></td><td>Alert details + complete JSON payload</td><td>From alert data</td></tr><tr><td><strong>Security Event Type</strong></td><td>audit_alert_resumed</td><td>From <code>audit_event</code> (custom field)</td></tr><tr><td><strong>Remote Address</strong></td><td>110.227.52.162</td><td>From <code>remote_address</code> (custom field)</td></tr><tr><td><strong>Timestamp</strong></td><td>2025-11-05 05:00:28</td><td>From <code>timestamp</code></td></tr><tr><td><strong>Status</strong></td><td>Pending</td><td>Default workflow status</td></tr></tbody></table>

**Key Details Captured:**

* Alert Type: audit\_alert\_resumed
* Alert Name: Jira Alerts
* Username: <john.doe@company.com>
* Timestamp: 2025-11-05T05:00:28.091Z
* Source: Keeper Security
* Complete Raw Payload: Full JSON preserved for audit trail

**Response Timeline**

| Time      | Action                                     | Owner           |
| --------- | ------------------------------------------ | --------------- |
| **T+0s**  | Alert detected in Keeper                   | Keeper Security |
| **T+2s**  | Jira ticket OPS-3346 created automatically | Forge App       |
| **T+1m**  | Operations team notified                   | Jira            |
| **T+5m**  | Team reviews audit activity                | Operations Team |
| **T+15m** | Investigation completed, ticket resolved   | Operations Team |

{% hint style="success" %}
**Total response time: 15 minutes** (vs. hours with manual process)
{% endhint %}

## Supported Alerts

The integration supports over 300 detailed Keeper Security event types as described in the table below.

{% embed url="<https://docs.google.com/spreadsheets/d/1VzR44EdqlXIchpbmqhj45-zzfD6e4qR35bJVheWSfVQ/edit?gid=0#gid=0>" %}
Keeper Security Event Types
{% endembed %}

## Role-Based Access Control

The integration implements role-based access control (RBAC) to protect configuration settings.

#### Permission Levels

| User Role                 | Access Level                     |
| ------------------------- | -------------------------------- |
| **Jira Administrator**    | Full access to all configuration |
| **Project Administrator** | View access denied screen        |
| **Regular User**          | View access denied screen        |

#### What is Protected

| Area                                  | Protection          |
| ------------------------------------- | ------------------- |
| **All configuration save operations** | Requires Jira Admin |
| **Project and issue type selection**  | Requires Jira Admin |
| **Field mapping configuration**       | Requires Jira Admin |
| **Priority mapping configuration**    | Requires Jira Admin |
| **Configuration reset functionality** | Requires Jira Admin |

## Troubleshooting

#### Issue: "Allow access" button appears repeatedly

**Cause:** Development environment or missing admin consent

**Solution:**

* If using development environment, deploy to production
* Or grant admin consent as Jira Administrator
* Production environment allows one-time consent for all users

#### Issue: Custom field not appearing in mappings

**Cause:** Field not associated with project or issue type

**Solution:**

1. Verify field is associated with your target project
2. Check field is associated with the issue type
3. Refresh the app page
4. Clear browser cache

#### Issue: Test webhook fails

**Cause:** Configuration not saved or issue type mismatch

**Solution:**

1. Ensure project is selected and saved
2. Verify issue type exists in project
3. Click "Reset Configuration" to regenerate mappings
4. Check browser console for errors

#### Issue: Tickets created but fields are empty

**Cause:** Field mappings not saved or fields don't exist

**Solution:**

1. Check field mappings are saved
2. Verify custom fields exist in Jira
3. Ensure Keeper payload contains expected fields
4. Review webhook payload in Keeper admin console

#### Issue: Cannot find app in Jira

**Cause:** App not enabled or insufficient permissions

**Solution:**

1. Go to **Settings → Apps → Manage apps**
2. Verify "Keeper Security ITSM" is enabled
3. Check you have project admin permissions
4. Access via: **Settings → Apps** (sidebar)

#### Issue: User is admin but sees access denied

**Cause:** User has project admin but not Jira admin

**Solution:**

* Verify the user has "Jira Administrator" global permission, not just project admin
* Check browser console for any API errors
* Verify the app has required scopes

#### Issue: Webhook returns "AUTHENTICATION\_FAILED" error

**Cause:** Invalid or missing Bearer token

**Solution:**

1. Verify token authentication is enabled in the Jira app
2. Check the Authorization header is correctly formatted: `Bearer <token>`
3. Ensure there are no extra spaces or line breaks in the token
4. Regenerate the token if it may have been compromised
5. Check Keeper webhook configuration includes the Authorization header

#### Issue: Token was lost or forgotten

**Cause:** Token only shown once at generation

**Solution:**

1. Tokens cannot be retrieved after generation (security feature)
2. Click **"Regenerate Token"** to create a new token
3. Update the Authorization header in Keeper with the new token
4. Old token is immediately invalidated

**Note:** After regenerating a token, all existing Keeper webhook configurations using the old token will fail until updated with the new token.

### Resources

* [Reporting, Alerts & SIEM](https://docs.keeper.io/enterprise-guide/event-reporting)
* [Keeper Webhooks](https://docs.keeper.io/enterprise-guide/webhooks)
* [Keeper Enterprise Guide](https://app.gitbook.com/o/-LO5CAzoigGmCWBUbw9z/s/-LO5CAzpxoaEquZJBpYz/)