Exporting Findings

Security for Jira allows users to export CSV files containing scan findings in the spaces for which they have administration privileges, or spaces that users granted explicit app access can view. This can be done from the Soteri Dashboard, or when viewing a particular space’s Security Analysis.

Exporting all scan findings from the Dashboard

To export all findings for all spaces you can see on the Dashboard, click the Export button at the top of the Soteri Dashboard, and select All Findings:

Exporting space findings from the Dashboard

To export findings for a particular space from the Soteri Dashboard, use the Findings button in the Action Menu for the space:

Exporting space findings from the Security Analysis page

Finally, when viewing the Security Analysis for a particular space, you can use the Export dropdown at the top of the page. The rule filter will also filter the exported findings.

Full findings in exported reports

If you want to add the full text of findings in exported reports, you can enable the Include full finding text in exported reports setting on the settings page:

Enabling this option will add the Work item summary, Historical, Finding text, Labeled?, Full text, Introduced by, and Introduced by account ID columns to CSV exports.

Performance

Security for Jira only stores the locations of findings, not their actual text. To perform an export, Security for Jira therefore must query Jira to retrieve the text of all content with findings, which can be very time consuming. This is particularly noticeable for full instance exports. A large full instance export can take hours, depending on Atlassian rate limits.

Columns in exported findings reports

Following are the column names in the exported reports, in order, most of which are self-explanatory:

1. Work item key

2. Work item summary. Excluded if the “Include full finding text in exported reports” setting is disabled.

3. Location type: FIELD, COMMENT, or ATTACHMENT

4. Field name

5. Comment ID: if the finding was from a comment.

6. Edit timestamp: last edited time

7. Historical: if this scan finding is historical. Excluded if the “Include full finding text in exported reports” setting is disabled.

8. Rule name

9. Confidence: for findings from Advanced AI Scanning , the confidence level reported by the model (0.0-1.0).

10. Finding text: the exact match text of the finding. This can be used to review the finding; see Hiding false positives, revoked credentials, etc.. Excluded if the “Include full finding text in exported reports” setting is disabled.

11. Reviewed?: if the finding is reviewed at space scope.

12. Globally reviewed?: if the finding is reviewed across all of Jira.

13. Individually reviewed?: if the finding is reviewed at field scope.

14. Labeled?: if the finding has the soteri-finding label. Excluded if the “Include full finding text in exported reports” setting is disabled.

15. Work item link: URL to the work item.

16. Security analysis link: URL to security analysis page for that Space.

17. Full text: the complete text of the fragment, or, if it is too long, then only the specific text that triggered the finding. Excluded if the “Include full finding text in exported reports” setting is disabled.

18. Attachment ID: The Jira ID of the attachment the finding was found in. Populated only for attachment findings.

19. Attachment filename: The filename of the attachment the finding was found in. Populated only for attachment findings.

20. Introduced by: The user the finding is attributed to. Excluded if the “Include full finding text in exported reports” setting is disabled.

21. Introduced by account ID: The Atlassian account ID the finding is attributed to. Excluded if the “Include full finding text in exported reports” setting is disabled.

More Export Settings

More settings for configuring and filtering export output are available via our REST API.