From 500297ec0a6871c582ab00542b99c34fad61f279 Mon Sep 17 00:00:00 2001
From: jakob-source <77107636+jakob-source@users.noreply.github.com>
Date: Wed, 18 Jan 2023 11:14:52 +0100
Subject: [PATCH 1/6] Create ReadMe.md

---
 Community Developed/Atlassian Jira/ReadMe.md | 7 +++++++
 1 file changed, 7 insertions(+)
 create mode 100644 Community Developed/Atlassian Jira/ReadMe.md

diff --git a/Community Developed/Atlassian Jira/ReadMe.md b/Community Developed/Atlassian Jira/ReadMe.md
new file mode 100644
index 00000000..bd1918c5
--- /dev/null
+++ b/Community Developed/Atlassian Jira/ReadMe.md	
@@ -0,0 +1,7 @@
+# Atlassian Jira
+The Jira workflow collects audit logs from audit API.
+
+## Authentication Set-Up
+When setting up the workflow for Atlassian Cloud you will need to use the "Jira User Identifier" and "Jira API Token" fields in the Workflow Parameter Values file. These will allow connection to the [Atlassian Cloud REST API](https://developer.atlassian.com/cloud/jira/platform/basic-auth-for-rest-apis/) via [Basic Authentication](https://developer.atlassian.com/cloud/jira/platform/basic-auth-for-rest-apis/).
+
+You need to uncheck Coalescing Events option during log source configuration. 

From 612d8ca66895de15999a9f8c3677c6194d0f2f2b Mon Sep 17 00:00:00 2001
From: jakob-source <77107636+jakob-source@users.noreply.github.com>
Date: Wed, 18 Jan 2023 11:20:29 +0100
Subject: [PATCH 2/6] Create AtlassianJira-Workflow.xml

---
 .../Atlassian Jira/AtlassianJira-Workflow.xml | 38 +++++++++++++++++++
 1 file changed, 38 insertions(+)
 create mode 100644 Community Developed/Atlassian Jira/AtlassianJira-Workflow.xml

diff --git a/Community Developed/Atlassian Jira/AtlassianJira-Workflow.xml b/Community Developed/Atlassian Jira/AtlassianJira-Workflow.xml
new file mode 100644
index 00000000..1a2a73c0
--- /dev/null
+++ b/Community Developed/Atlassian Jira/AtlassianJira-Workflow.xml	
@@ -0,0 +1,38 @@
+<?xml version="1.0" encoding="UTF-8" ?>
+<Workflow name="AtlassianJira" version="1.0" xmlns="http://qradar.ibm.com/UniversalCloudRESTAPI/Workflow/V1">
+
+    <Parameters>
+        <Parameter name="host" label="host" required="true" />
+        <Parameter name="token" label="token" required="true" />
+	      <Parameter name="user_id" label="user_id" required="true" />
+    </Parameters>
+
+    <Actions>
+
+        <Initialize path="/get_logs/offset" value="0" />
+        <CallEndpoint url="https://${/host}/rest/api/3/auditing/record" method="GET" savePath="/get_logs">
+	    <SSLConfiguration allowUntrustedServerCertificate="true" />
+	    <BasicAuthentication username="${/user_id}" password="${/token}" />
+	    <QueryParameter name="offset=" value="${/get_logs/offset}" />
+	    <QueryParameter name="limit=" value="1000" />
+            <RequestHeader name="Content-Type" value="application/json" />
+        </CallEndpoint>
+
+        <!-- Handle Errors -->
+        <If condition="/get_logs/status_code != 200">
+            <Abort reason="${/get_logs}" />
+        </If>
+
+        <!-- Post Events -->
+        <PostEvents path="/get_logs/body/records" source="${/host}"/>
+
+        <!-- Update the bookmark -->
+        <Set path="/get_logs/offset" value="${/get_logs/body/total}" />
+
+    </Actions>
+
+    <Tests>
+        <DNSResolutionTest host="${/host}" />
+    </Tests>
+
+</Workflow>

From a3ccd9cb5611d92249bf8657b74fa61b58fed8f2 Mon Sep 17 00:00:00 2001
From: jakob-source <77107636+jakob-source@users.noreply.github.com>
Date: Wed, 18 Jan 2023 11:22:41 +0100
Subject: [PATCH 3/6] Create AtlassianJira-Workflow-Parameter-Values.xml

---
 .../AtlassianJira-Workflow-Parameter-Values.xml             | 6 ++++++
 1 file changed, 6 insertions(+)
 create mode 100644 Community Developed/Atlassian Jira/AtlassianJira-Workflow-Parameter-Values.xml

diff --git a/Community Developed/Atlassian Jira/AtlassianJira-Workflow-Parameter-Values.xml b/Community Developed/Atlassian Jira/AtlassianJira-Workflow-Parameter-Values.xml
new file mode 100644
index 00000000..d4f43134
--- /dev/null
+++ b/Community Developed/Atlassian Jira/AtlassianJira-Workflow-Parameter-Values.xml	
@@ -0,0 +1,6 @@
+<?xml version="1.0" encoding="UTF-8" ?>
+<WorkflowParameterValues xmlns="http://qradar.ibm.com/UniversalCloudRESTAPI/WorkflowParameterValues/V1">
+    <Value name="host"        value="" />
+    <Value name="user_id"     value="" />
+    <Value name="token"       value="" />
+</WorkflowParameterValues>

From c1417c1d83507114e298d9103da8a488608ad129 Mon Sep 17 00:00:00 2001
From: jakob-source <77107636+jakob-source@users.noreply.github.com>
Date: Wed, 18 Jan 2023 11:25:02 +0100
Subject: [PATCH 4/6] Update AtlassianJira-Workflow.xml

---
 Community Developed/Atlassian Jira/AtlassianJira-Workflow.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Community Developed/Atlassian Jira/AtlassianJira-Workflow.xml b/Community Developed/Atlassian Jira/AtlassianJira-Workflow.xml
index 1a2a73c0..7188c265 100644
--- a/Community Developed/Atlassian Jira/AtlassianJira-Workflow.xml	
+++ b/Community Developed/Atlassian Jira/AtlassianJira-Workflow.xml	
@@ -20,7 +20,7 @@
 
         <!-- Handle Errors -->
         <If condition="/get_logs/status_code != 200">
-            <Abort reason="${/get_logs}" />
+            <Abort reason="${/get_logs/status_code}" />
         </If>
 
         <!-- Post Events -->

From 32761d36729948f490e8420f3eeec0cba1d103f4 Mon Sep 17 00:00:00 2001
From: jakob-source <77107636+jakob-source@users.noreply.github.com>
Date: Wed, 18 Jan 2023 14:43:26 +0100
Subject: [PATCH 5/6] Update AtlassianJira-Workflow.xml

---
 .../Atlassian Jira/AtlassianJira-Workflow.xml               | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/Community Developed/Atlassian Jira/AtlassianJira-Workflow.xml b/Community Developed/Atlassian Jira/AtlassianJira-Workflow.xml
index 7188c265..3f883132 100644
--- a/Community Developed/Atlassian Jira/AtlassianJira-Workflow.xml	
+++ b/Community Developed/Atlassian Jira/AtlassianJira-Workflow.xml	
@@ -9,11 +9,11 @@
 
     <Actions>
 
-        <Initialize path="/get_logs/offset" value="0" />
+        <Initialize path="/get_logs/bookmark" value="0" />
         <CallEndpoint url="https://${/host}/rest/api/3/auditing/record" method="GET" savePath="/get_logs">
 	    <SSLConfiguration allowUntrustedServerCertificate="true" />
 	    <BasicAuthentication username="${/user_id}" password="${/token}" />
-	    <QueryParameter name="offset=" value="${/get_logs/offset}" />
+	    <QueryParameter name="offset=" value="${/get_logs/bookmark}" />
 	    <QueryParameter name="limit=" value="1000" />
             <RequestHeader name="Content-Type" value="application/json" />
         </CallEndpoint>
@@ -27,7 +27,7 @@
         <PostEvents path="/get_logs/body/records" source="${/host}"/>
 
         <!-- Update the bookmark -->
-        <Set path="/get_logs/offset" value="${/get_logs/body/total}" />
+        <Set path="/get_logs/bookmark" value="${/get_logs/body/total}" />
 
     </Actions>
 

From e72d30cbc2971c099d9a5a1d5acd16d310ed9b78 Mon Sep 17 00:00:00 2001
From: jakob-source <77107636+jakob-source@users.noreply.github.com>
Date: Thu, 19 Jan 2023 16:42:19 +0100
Subject: [PATCH 6/6] Update AtlassianJira-Workflow.xml

---
 .../Atlassian Jira/AtlassianJira-Workflow.xml | 22 +++++++++----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/Community Developed/Atlassian Jira/AtlassianJira-Workflow.xml b/Community Developed/Atlassian Jira/AtlassianJira-Workflow.xml
index 3f883132..9e4bb8c5 100644
--- a/Community Developed/Atlassian Jira/AtlassianJira-Workflow.xml	
+++ b/Community Developed/Atlassian Jira/AtlassianJira-Workflow.xml	
@@ -4,17 +4,18 @@
     <Parameters>
         <Parameter name="host" label="host" required="true" />
         <Parameter name="token" label="token" required="true" />
-	      <Parameter name="user_id" label="user_id" required="true" />
+	<Parameter name="user_id" label="user_id" required="true" />
     </Parameters>
 
     <Actions>
-
-        <Initialize path="/get_logs/bookmark" value="0" />
+	<!-- Setting up initial timeframe for last 10 mins -->
+        <Initialize path="/time" value="${time()-( 10 * 60 * 1000)}" />
+	<!-- Convert time into Atlassian API supported format. Addin 1 sec in order no to receive same event twice on a next iteration -->
+        <FormatDate pattern="yyyy-MM-dd'T'HH:mm:ss.SSSZ" timeZone="UTC" time="${/time+(1)}" savePath="/bookmark" />
         <CallEndpoint url="https://${/host}/rest/api/3/auditing/record" method="GET" savePath="/get_logs">
 	    <SSLConfiguration allowUntrustedServerCertificate="true" />
 	    <BasicAuthentication username="${/user_id}" password="${/token}" />
-	    <QueryParameter name="offset=" value="${/get_logs/bookmark}" />
-	    <QueryParameter name="limit=" value="1000" />
+	    <QueryParameter name="from" value="${/bookmark}" />
             <RequestHeader name="Content-Type" value="application/json" />
         </CallEndpoint>
 
@@ -23,12 +24,11 @@
             <Abort reason="${/get_logs/status_code}" />
         </If>
 
-        <!-- Post Events -->
-        <PostEvents path="/get_logs/body/records" source="${/host}"/>
-
-        <!-- Update the bookmark -->
-        <Set path="/get_logs/bookmark" value="${/get_logs/body/total}" />
-
+        <!-- Checking if response contains records. Collecting latest timestamp -->
+	<If condition="${count(/get_logs/body/records)} != 0">
+            <PostEvents path="/get_logs/body/records" source="${/host}"/>
+            <Set path="/time" value="${max(/get_logs/body/records/created)}" />
+	</If>
     </Actions>
 
     <Tests>