Jira Automation Rules -- Defender Workflow

How to set up automation rules in the DEVOPS Jira project to enforce SLAs, maintain label consistency, notify on new findings, and escalate overdue items.

Prerequisites

• Jira project admin access to the DEVOPS project
• Automation for Jira enabled (built-in, free on all Jira Cloud plans)
• Access to: https://authentica.atlassian.net/jira/software/projects/DEVOPS/settings/automate

Rule 1: SLA Reminder — High Findings Stale 7+ Days

Purpose

When a High-severity Defender finding has been in “To Do” for 7 or more days, post a comment reminding the team to triage or begin work.

Configuration

Setting	Value
Trigger	Scheduled — daily at 09:00 CT
JQL Condition	project = DEVOPS AND labels = Defender AND labels = defender-high AND status = "To Do" AND created <= -7d
Action	For each matching issue: add comment

Comment Template

⚠️ *SLA Reminder*: This High-severity Defender finding has been in "To Do" since {{issue.created.shortFormat}}.

High-severity findings have a *1-week SLA*. Please triage and begin work, reassign, or escalate.

Assignee: {{issue.assignee.displayName}} | Epic: {{issue.parent.key}}

Setup Steps

1. Navigate to DEVOPS project > Project Settings > Automation
2. Click Create rule
3. Trigger: Select “Scheduled”
   • Set Start date to the next business day
   • Set Occurrence to every 1 Day at 9:00 AM, timezone America/Chicago (CT)
   • Check “Run a JQL search and execute actions for each work item in the query”
   • Paste the JQL: project = DEVOPS AND labels = Defender AND labels = defender-high AND status = "To Do" AND created <= -7d
   • Click Next
4. THEN: Add an action > Select “Add comment”
   • Paste the comment template above
   • Set comment visibility to “All users”
5. Click Rule details (top right) and name the rule: Defender: SLA reminder -- High stale 7d
6. Click Turn it on

Verification

• Check Automation > Audit log the next day to see if the rule ran
• To test immediately: edit the rule and click “Run rule” (or temporarily change created <= -7d to created <= -1d)
• Confirm comments appear on matching issues

---

Rule 2: Auto-Label on Epic Change

Purpose

When a Defender issue is moved to a different severity Epic, automatically update the severity label to match. This prevents label/epic drift.

Configuration

Setting	Value
Trigger	Field value changed — field: “Parent”
Condition	Issue has the Defender label
Action	If/else branches to set the matching severity label

Epic-to-Label Mapping

Epic Key	Epic Name	Label to Set	Labels to Remove
DEVOPS-82	Defender - High	defender-high	defender-medium, defender-low, defender-nonissue, defender-wontdo
DEVOPS-83	Defender - Medium	defender-medium	defender-high, defender-low, defender-nonissue, defender-wontdo
DEVOPS-84	Defender - Low	defender-low	defender-high, defender-medium, defender-nonissue, defender-wontdo
DEVOPS-85	Defender - Non-Issue	defender-nonissue	defender-high, defender-medium, defender-low, defender-wontdo
DEVOPS-86	Defender - Won’t Do	defender-wontdo	defender-high, defender-medium, defender-low, defender-nonissue

Setup Steps

1. Navigate to DEVOPS project > Project Settings > Automation
2. Click Create rule
3. Trigger: Select “Field value changed” > Field: “Parent”
4. Component — New condition: Select “JQL condition”
   • Paste: labels = Defender
5. Component — New condition: Select “If/else block”

Branch 1 (High):

• Condition: {{issue.parent.key}} equals DEVOPS-82
• Action: “Edit issue”
  • Add labels: defender-high
  • Remove labels: defender-medium, defender-low, defender-nonissue, defender-wontdo

Branch 2 (Medium):

• Else if: {{issue.parent.key}} equals DEVOPS-83
• Action: “Edit issue”
  • Add labels: defender-medium
  • Remove labels: defender-high, defender-low, defender-nonissue, defender-wontdo

Branch 3 (Low):

• Else if: {{issue.parent.key}} equals DEVOPS-84
• Action: “Edit issue”
  • Add labels: defender-low
  • Remove labels: defender-high, defender-medium, defender-nonissue, defender-wontdo

Branch 4 (Non-Issue):

• Else if: {{issue.parent.key}} equals DEVOPS-85
• Action: “Edit issue”
  • Add labels: defender-nonissue
  • Remove labels: defender-high, defender-medium, defender-low, defender-wontdo

Branch 5 (Won’t Do):

• Else if: {{issue.parent.key}} equals DEVOPS-86
• Action: “Edit issue”
  • Add labels: defender-wontdo
  • Remove labels: defender-high, defender-medium, defender-low, defender-nonissue

6. Name the rule: Defender: Auto-label on epic change
7. Click Turn it on

Verification

• Move a test Defender issue to a different Epic
• Confirm the severity label updates within a few seconds
• Check that only the matching label remains (old severity label removed)

---

Rule 3: Intake Notification for New Defender Issues

Purpose

When a new issue with the Defender label is created, send an email notification to the team so new findings don’t go unnoticed.

Configuration

Setting	Value
Trigger	Issue created
Condition	JQL: labels = Defender
Action	Send email notification

Email Template

Subject:

[Defender] New finding: {{issue.key}} -- {{issue.summary}}

Body:

A new Defender for Cloud finding has been created in the DEVOPS project.

Issue: {{issue.key}} -- {{issue.summary}}
Priority: {{issue.priority.name}}
Epic: {{issue.parent.key}} ({{issue.parent.summary}})
Labels: {{issue.labels}}
Reporter: {{issue.reporter.displayName}}

Link: {{issue.url}}

Setup Steps

1. Navigate to DEVOPS project > Project Settings > Automation
2. Click Create rule
3. Trigger: Select “Issue created”
4. Component — New condition: Select “JQL condition”
   • Paste: labels = Defender
5. Component — New action: Select “Send email”
   • To: Enter the team distribution email or specific team members
   • Subject: Paste the subject template above
   • Body: Paste the body template above
6. Name the rule: Defender: Intake notification
7. Click Turn it on

Slack/Teams alternative

If you prefer Slack or Teams notifications, replace the “Send email” action with “Send Slack message” or “Send Microsoft Teams message” and configure the webhook URL. The message template is the same.

Verification

• Create a test issue with the Defender label
• Confirm the notification email arrives within a minute
• Delete the test issue afterward

---

Rule 4: Overdue Escalation — High + Prod, 14+ Days

Purpose

When a High-severity production finding exceeds 14 days open (in any status except Done), automatically escalate: bump priority to Highest, add an overdue label, and post an escalation comment.

Configuration

Setting	Value
Trigger	Scheduled — daily at 09:00 CT
JQL Condition	project = DEVOPS AND labels = Defender AND labels = defender-high AND labels = env-prod AND status != Done AND created <= -14d
Actions	For each matching issue: edit issue (priority + label), add comment

Comment Template

🚨 *Escalation*: This High-severity production Defender finding has been open since {{issue.created.shortFormat}}, exceeding the 14-day escalation threshold.

The SLA for High-severity findings is *1 week*. This item requires immediate attention.

Please update status, document blockers, or escalate to team lead.

Setup Steps

1. Navigate to DEVOPS project > Project Settings > Automation
2. Click Create rule
3. Trigger: Select “Scheduled”
   • Set Start date to the next business day
   • Set Occurrence to every 1 Day at 9:00 AM, timezone America/Chicago (CT)
   • Check “Run a JQL search and execute actions for each work item in the query”
   • Paste the JQL: project = DEVOPS AND labels = Defender AND labels = defender-high AND labels = env-prod AND status != Done AND created <= -14d
   • Click Next
4. THEN: Add an action > Select “Edit issue”
   • Set priority: Highest
   • Add label: overdue
5. THEN: Add an action > Select “Add comment”
   • Paste the comment template above
6. Click Rule details (top right) and name the rule: Defender: Overdue escalation -- High+prod 14d
7. Click Turn it on

Avoid duplicate escalation

The overdue label is additive — once added, it stays. The rule will fire again the next day and add another comment. To prevent this, add AND labels != overdue to the JQL in the trigger. This way the rule only fires once per issue. After the issue is resolved, the overdue label can be left as historical record.

Verification

• Check Automation > Audit log the next day
• To test immediately: edit the rule and click “Run rule” (or create a test issue dated 15+ days ago with defender-high and env-prod labels)
• Confirm the priority changes to Highest, overdue label is added, and comment appears

---

Troubleshooting

Problem	Cause	Fix
Rule not firing	JQL returns 0 results	Run the JQL manually in Jira search to verify it matches issues
Rule not firing	Schedule timezone mismatch	Check rule schedule timezone matches your expectation
Duplicate comments	Scheduled rule runs without dedup check	Add AND labels != overdue condition (Rule 4) or similar dedup logic
Labels not updating (Rule 2)	Parent field name mismatch	Verify the field is “Parent” (next-gen projects) vs “Epic Link” (classic projects)
Email not received (Rule 3)	Notification suppressed by Jira	Check recipient’s Jira notification preferences and spam folder
Smart values not resolving	Syntax error in template	Test with {{issue.key}} first, then add more complex values

Maintenance

• Review the Automation > Audit log weekly during the weekly review
• Adjust SLA thresholds if team capacity or priorities change
• Update notification recipients when team membership changes
• If Epics are reorganized (new keys), update Rule 2’s if/else branches