Jira · Jira Service Management · v1.0.0 · Build complete
AlertBridge
for CrowdStrike Falcon®
Turn Falcon detections into Jira and Jira Service Management issues — with the whole investigation already attached.
Built and verified end-to-end against a live Jira site. Marketplace listing in preparation.
- Real-time webhook
- Polling fallback
- Never duplicates
- Full alert context
The gap it closes
A detection fires in the Falcon console. The person who has to act on it works in Jira. Between those two facts sits a copy-and-paste job that happens at 2am, badly, or does not happen at all.
The official routes do exist, and they are heavier than the problem: CrowdStrike’s own Jira action lives behind additional paid modules, and Jira Service Management’s built-in connector is limited to its higher plan tiers. If you are on Jira Software, or JSM Standard, or you simply have not bought the extra SIEM licence, there is nothing between you and the copy-paste.
AlertBridge is the small, direct version: your own Falcon API client, your own Jira project, and an issue that appears with the full context already in it.
How it works
Three steps, then it runs itself.
- 01
Connect your own Falcon API client
Create an API client in the Falcon console with the Alerts (Read) scope — nothing more — and paste the credentials into the app’s admin page. Choose your Falcon cloud region: US-1, US-2, EU-1, US-GOV-1 or US-GOV-2.
- 02
Pick the project, the issue type and the floor
Choose where issues land and the minimum severity worth creating one for. A staged connection test then checks your credentials, the Alerts scope and the Jira project separately, so a failure tells you exactly which one is wrong.
- 03
Choose real-time, scheduled, or both
Point a Falcon Fusion workflow at the app’s webhook for delivery within seconds, or let it poll the Alerts API every hour or every five minutes — no Fusion required. Running both at once is safe: the same detection can never produce two issues.
How it behaves
The decisions that matter.
-
One detection, one issue — permanently
Every alert is keyed on its Falcon composite ID. A replayed webhook, an overlapping poll, or both lanes running at once all resolve to the same issue rather than a duplicate.
-
A thin webhook still produces a complete issue
The webhook payload is treated as a doorbell, not a source of truth. Given credentials, the app re-fetches the authoritative alert from the Alerts API and merges it, so a minimal Fusion template still yields a fully populated issue.
-
Alerts without a severity are never silently dropped
Some threat-hunting leads arrive with no severity field at all. Rather than failing the severity filter and vanishing, they are always created — a hands-on-keyboard lead is the last thing that should be filtered out by a technicality.
-
A failed issue is retried, not lost
The polling watermark only advances past alerts that were genuinely processed. If Jira rejects a write, that alert is picked up on the next run instead of being skipped forever.
-
Wrong credentials say so, in English
The failure paths were tested against the live Falcon endpoint rather than assumed. An unknown client ID and a bad secret return different HTTP codes; both are reported as “Falcon rejected the API credentials”, with Falcon’s own message, instead of an unexplained error.
-
Your secret is never readable, including by the app’s own UI
The client secret goes into Forge encrypted secret storage. The admin screen can only ever learn whether a secret exists — the value itself is never returned to the browser.
Where it runs, and what it reaches
Every outbound connection, named.
The app runs on Atlassian’s own infrastructure. Where it must reach outside, these are the only hostnames it is permitted to contact — the same list Atlassian shows your admin before you install, and the same list a Marketplace reviewer checks against the manifest.
-
api.crowdstrike.comUS-1 Falcon cloud — authenticate with your credentials and read your alerts. -
api.us-2.crowdstrike.comUS-2 Falcon cloud — same purpose, different region. -
api.eu-1.crowdstrike.comEU-1 Falcon cloud — same purpose, different region. -
api.laggar.gcw.crowdstrike.comUS-GOV-1 Falcon cloud — same purpose, different region. -
api.us-gov-2.crowdstrike.milUS-GOV-2 Falcon cloud — same purpose, different region.
Runs on
Atlassian Forge (runs on Atlassian’s own infrastructure)
Your credentials live in
Forge encrypted secret storage, inside your own installation
Surfaces it adds
Jira admin page, Issue panel, Web trigger (webhook), Scheduled trigger
Pricing
Priced per user, billed by Atlassian.
Every paid plan starts with a free 30-day evaluation, arranged by Atlassian. Atlassian collects the payment, handles invoicing and tax, and is the merchant of record — so this app appears on the Atlassian bill you already pay, not a separate one from me. Sites of ten users or fewer pay one flat monthly rate.
Evaluation
Free
Up to 10 users
$15/month
11–100 users
$1.50/user/mo
101+ users
$1.00/user/mo
Indicative pricing for an app that is not listed yet. The rate on the Marketplace listing is the one that applies.
Documentation & data handling
Everything it touches, stated plainly.
Installing & getting started
- Install AlertBridge from the Atlassian Marketplace into your Jira site and review the permissions listed here.
- Open Settings → Apps → AlertBridge and work through the three steps above.
- Your evaluation runs for 30 days with everything switched on, so it can prove itself before you pay for it.
- Stuck? Email [email protected] — one business day response.
Permissions, and why each one
read:jira-work- Verify the destination project and issue type exist before writing, and read the stored alert context back for the issue panel.
write:jira-work- Create the issue from the detection and attach its context — the core function of the app.
storage:app- Hold the configuration, the encrypted Falcon secret, and the de-duplication keys inside your own installation.
What is stored, and where
- Your Falcon client secret is stored in Forge encrypted secret storage inside your own installation. It is never returned to the browser, never written to logs, and is not accessible to me.
- Alert content lives in your Jira site — as issue fields, and as an issue property that powers the alert panel. No copy is kept anywhere else.
- The only additional record is a de-duplication key per alert: the Falcon alert ID paired with the issue it created, held in your installation’s own storage and expired automatically after 45 days.
- Outbound connections go only to the Falcon cloud you select, using your credentials, to reach your own tenant. Those hostnames are declared in the app manifest and shown to your admin at install time.
- Uninstalling the app removes its stored configuration, the encrypted secret and the de-duplication keys. Issues it already created are yours and stay where they are.
Technical detail
- Version
- 1.0.0
- Platform
- Atlassian Forge
- Runtime
- Node.js 22 — Forge runtime
- Products
- Jira, Jira Service Management
- Modules
- Jira admin page, Issue panel, Web trigger (webhook), Scheduled trigger
- External connections
- 5 declared hosts
- Billing
- Paid through the Atlassian Marketplace
- Support
- [email protected]
- Support SLA
- One business day
- Publisher
- Builds By Luke, Canada
CrowdStrike® and Falcon® are registered trademarks of CrowdStrike, Inc. AlertBridge is an independent product, not affiliated with, endorsed by or sponsored by CrowdStrike, Inc. It requires your own CrowdStrike subscription and your own API credentials.
Questions people ask.
Do I need any extra CrowdStrike modules?
No. Polling needs only an API client with the Alerts (Read) scope, which every Falcon subscription can create. Fusion workflows are optional and only used if you want sub-minute delivery.
Which Falcon regions are supported?
All five: US-1, US-2, EU-1, US-GOV-1 and US-GOV-2. You choose yours during setup.
What if I run the webhook and polling at the same time?
Nothing bad. De-duplication is keyed on the Falcon alert ID, so whichever lane sees a detection first creates the issue and the other recognises it.
Can it write anything back to CrowdStrike?
Not in version one. It asks for read access to alerts and nothing else. Status write-back is on the roadmap as an explicit opt-in.
Where does my Falcon secret actually live?
In Forge encrypted secret storage, inside your own Atlassian installation. It is never displayed after saving, never sent to the app’s front end, and never leaves Atlassian except to authenticate against the Falcon cloud you chose.
Does it work with Jira Service Management?
Yes — point it at a JSM project and detections arrive as tickets in your queue, with the same context and the same deep link back to Falcon.
AlertBridge is on its way.
It is on the build list for the Atlassian Marketplace. If you want it sooner — or want it to do one specific thing — that is genuinely useful to hear.