samples/security/external security findings/jira_tickets_for_critical_container_vulnerabilities.yaml

metadata:
  version: "1"
  dependencies:
    apps:
      - id: dynatrace.automations
        version: ^1.700.0
      - id: dynatrace.jira
        version: ^4.0.0
  inputs:
    - type: connection
      schema: app:dynatrace.jira:connection
      targets:
        - tasks.create_task_in_jira.connectionId
workflow:
  title: "[Sample] Container Vulnerability Alerts - Jira Tickets"
  tasks:
    get_vulnerabilites:
      name: get_vulnerabilites
      description: Query for new vulnerability findings in the last 24 hours.
      action: dynatrace.automations:execute-dql-query
      active: true
      input:
        query: >-
          // The query has a rolling window of 7 days and the last 24hrs.

          // Vulnerability finding events which have already been reported

          // before the current 24hr window will not be reported again.

          fetch events, from: now() - 7d

          | filter dt.system.bucket == "default_security_custom_events"
              AND event.kind == "SECURITY_EVENT"
              AND object.type == "CONTAINER_IMAGE"
              AND event.type == "VULNERABILITY_FINDING"
              AND dt.security.risk.level == "CRITICAL"
          // Aggregate vulnerability findings per vulnerability, repository, 

          // component and component version.

          | summarize {
                affected_images_count = count(),
                vulnerability_finding_events = collectArray(
                  record(
                    object.id = object.id,
                    event.provider = event.provider,
                    container_image.digest,
                    container_image.registry = container_image.registry,
                    container_image.repository = container_image.repository,
                    container_image.tags = container_image.tags,
                    component.version = component.version,
                    component.name = component.name,
                    dt.security.risk.level = dt.security.risk.level,
                    ingest_time = timestamp
                  )
                )
              }, by:{ vulnerability.id, vulnerability.title, event.provider, container_image.registry, container_image.repository, component.name, component.version }
          // Filter out, if this vulnerability for the repository and the
          component 

          // and version was already reported before the last 24 hours.

          // For example, if the same vulnerability was reported multiple times

          // during the last 7 days, don't report it again.

          | filterOut iAny(vulnerability_finding_events[][ingest_time] < now() -
          24h)

          // Expand and deduplicate for repetitive findings if they

          // were reported more than once in the last 24 hours.

          | expand vulnerability_finding_events

          | dedup { vulnerability.id, vulnerability.title,
          vulnerability_finding_events[object.id],
          vulnerability_finding_events[component.name],
          vulnerability_finding_events[component.version] } 

          // Aggregate again to count the unique affected images within each
          repository.

          | summarize {
                affected_images_count = count(),
                vulnerability_finding_events = collectArray(
                  vulnerability_finding_events
                )
              }, by:{ vulnerability.id, vulnerability.title, event.provider, container_image.registry, container_image.repository, component.name, component.version }
          | sort vulnerability_finding_events[][ingest_time] desc
      customSampleResult: {}
      position:
        x: 0
        y: 1
      predecessors: []
      conditions:
        states: {}
        custom: ""
    create_task_in_jira:
      name: create_task_in_jira
      description: Create a Jira ticket for the vulnerability findings.
      action: dynatrace.jira:jira-create-issue
      active: true
      input:
        labels: []
        taskId: "{{ task().id }}"
        project:
          id: null
        summary: '{{
          (_.finding.vulnerability_finding_events|first).get("dt.security.risk.level")
          }} vulnerability {{ _.finding.get("vulnerability.id") }} was detected
          in {{
          (_.finding.vulnerability_finding_events|first).get("container_image.repository")
          }}'
        assignee:
          id: "-1"
        priority: null
        reporter:
          id: null
        issueType:
          id: null
        components: []
        description: >-
          *Finding source:* {{
          (_.finding.vulnerability_finding_events|first).get("event.provider")
          }}

          *Registry ID:* {{
          (_.finding.vulnerability_finding_events|first).get("container_image.registry")
          }}

          *Repository name:* {{
          (_.finding.vulnerability_finding_events|first).get("container_image.repository")
          }}

          *Number of affected images:* {{_.finding.affected_images_count}}

          *Vulnerable component (version):* {{
          (_.finding.vulnerability_finding_events|first).get("component.name")
          }} ({{
          (_.finding.vulnerability_finding_events|first).get("component.version")
          }})


          *Vulnerability severity:* {{
          (_.finding.vulnerability_finding_events|first).get("dt.security.risk.level")
          }}

          *Vulnerability title:* {{ _.finding.get("vulnerability.title") }}

          *Vulnerability ID:* {{ _.finding.get("vulnerability.id") }}


          [View all vulnerability findings in a notebook.|{{ environment().url
          }}/ui/intent/dynatrace.notebooks/view-query#%7B%22dt.query%22%3A%22fetch%20events%5Cn%2F%2F%20data%20access%5Cn%7C%20filter%20dt.system.bucket%20%3D%3D%20%5C%22default_security_custom_events%5C%22%5Cn%20%20%20%20%20AND%20event.type%20%3D%3D%20%5C%22VULNERABILITY_FINDING%5C%22%5Cn%20%20%20%20%20AND%20object.type%3D%3D%5C%22CONTAINER_IMAGE%5C%22%5Cn%20%20%20%20%20AND%20isNotNull(component.name)%5Cn%7C%20dedup%20%7Bobject.id%2C%20vulnerability.id%2C%20component.name%2C%5Cn%20%20%20%20%20%20%20%20%20container_image.registry%2C%20container_image.repository%2C%20container_image.tags%7D%2C%20sort%3A%20%7Btimestamp%20desc%7D%5Cn%2F%2F%20aggregation%20and%20custom%20filtering%5Cn%7C%20sort%20timestamp%20desc%22%2C%22dt.timeframe%22%3A%7B%22from%22%3A%22now()-7d%22%2C%22to%22%3A%22now()%22%7D%2C%22hideInput%22%3Afalse%2C%22sourceApplication%22%3A%22dynatrace.notebooks%22%2C%22title%22%3A%22List%20recent%20container%20vulnerability%20findings%22%2C%22visualization%22%3A%22recordView%22%2C%22visualizationSettings%22%3A%7B%22thresholds%22%3A%5B%5D%2C%22chartSettings%22%3A%7B%22gapPolicy%22%3A%22connect%22%2C%22circleChartSettings%22%3A%7B%22groupingThresholdType%22%3A%22relative%22%2C%22groupingThresholdValue%22%3A0%2C%22valueType%22%3A%22relative%22%7D%2C%22categoryOverrides%22%3A%7B%7D%2C%22categoricalBarChartSettings%22%3A%7B%22categoryAxis%22%3A%22object.id%22%2C%22categoryAxisLabel%22%3A%22object.id%22%2C%22valueAxis%22%3A%22dt.security.risk.score%22%2C%22valueAxisLabel%22%3A%22dt.security.risk.score%22%7D%2C%22hiddenLegendFields%22%3A%5B%5D%2C%22fieldMapping%22%3A%7B%22timestamp%22%3A%22timestamp%22%2C%22leftAxisValues%22%3A%5B%22dt.security.risk.score%22%5D%2C%22leftAxisDimensions%22%3A%5B%22ResponseMetadata%22%5D%7D%7D%2C%22singleValue%22%3A%7B%22showLabel%22%3Atrue%2C%22label%22%3A%22%22%2C%22prefixIcon%22%3A%22%22%2C%22recordField%22%3A%22timestamp%22%2C%22autoscale%22%3Atrue%2C%22alignment%22%3A%22center%22%2C%22colorThresholdTarget%22%3A%22value%22%7D%2C%22table%22%3A%7B%22rowDensity%22%3A%22condensed%22%2C%22enableSparklines%22%3Afalse%2C%22hiddenColumns%22%3A%5B%5D%2C%22lineWrapIds%22%3A%5B%5D%2C%22firstVisibleRowIndex%22%3A0%2C%22columnWidths%22%3A%7B%7D%7D%2C%22honeycomb%22%3A%7B%22shape%22%3A%22hexagon%22%2C%22legend%22%3A%22auto%22%2C%22dataMappings%22%3A%7B%22category%22%3A%22ResponseMetadata%22%2C%22value%22%3A%22timestamp%22%7D%7D%2C%22histogram%22%3A%7B%22dataMappings%22%3A%5B%7B%22valueAxis%22%3A%22dt.security.risk.score%22%2C%22rangeAxis%22%3A%22%22%7D%5D%7D%7D%7D]


          ||Image Tags||Image digest (SHA256)||Scan time||

          {% for entity in _.finding.vulnerability_finding_events %}
            |{{ entity.get("container_image.tags") }}|{{ entity.get("container_image.digest") }}|{{ entity.get("ingest_time") }}|
          {% endfor %}
        executionId: "{{ execution().id }}"
        connectionId: ""
        fieldSetters: []
        environmentUrl: ""
      position:
        x: 0
        y: 2
      predecessors:
        - get_vulnerabilites
      conditions:
        states:
          get_vulnerabilites: SUCCESS
        custom: '{{result("get_vulnerabilites").records|length > 0}}'
      concurrency: 1
      withItems: finding in {{ result("get_vulnerabilites").records }}
  description: ""
  trigger:
    schedule:
      rule: null
      trigger:
        type: time
        time: 08:00
      timezone: Europe/Vienna
      isActive: false
      isFaulty: false
      filterParameters:
        earliestStart: 2024-04-10
      inputs: {}
  schemaVersion: 3