{
  "name": "Create or Comment Jira Issues for Splunk Alerts",
  "tags": [
    {
      "id": "GCHVocImoXoEVnzP",
      "name": "🛠️ In progress",
      "createdAt": "2023-10-31T02:17:21.618Z",
      "updatedAt": "2023-10-31T02:17:21.618Z"
    },
    {
      "id": "QPJKatvLSxxtrE8U",
      "name": "Secops",
      "createdAt": "2023-10-31T02:15:11.396Z",
      "updatedAt": "2023-10-31T02:15:11.396Z"
    }
  ],
  "nodes": [
    {
      "id": "create-or-comment-jira-issues-for-splunk-alerts-0",
      "name": "Webhook",
      "type": "n8n-nodes-base.webhook",
      "position": [
        -640,
        320
      ],
      "parameters": {
        "path": "create-or-comment-jira-issues-for-splunk-alerts",
        "options": {},
        "httpMethod": "POST",
        "authentication": "headerAuth"
      },
      "typeVersion": 1
    },
    {
      "id": "create-or-comment-jira-issues-for-splunk-alerts-1",
      "name": "Add Ticket Comment",
      "type": "n8n-nodes-base.jira",
      "position": [
        240,
        520
      ],
      "parameters": {
        "comment": "=Timestamp: {{ $('Set Host Name').item.json.body.timestamp }}\nDescription: {{ $('Set Host Name').item.json.body.description }}",
        "options": {},
        "issueKey": "={{ $json.key }}",
        "resource": "issueComment"
      },
      "typeVersion": 1
    },
    {
      "id": "create-or-comment-jira-issues-for-splunk-alerts-2",
      "name": "Search Ticket",
      "type": "n8n-nodes-base.jira",
      "position": [
        -200,
        320
      ],
      "parameters": {
        "options": {
          "jql": "=splunkhostname ~ \"{{ $json['splunk-host-name'] }}\" "
        },
        "operation": "getAll"
      },
      "typeVersion": 1,
      "alwaysOutputData": true
    },
    {
      "id": "create-or-comment-jira-issues-for-splunk-alerts-3",
      "name": "Set Host Name",
      "type": "n8n-nodes-base.set",
      "position": [
        -420,
        320
      ],
      "parameters": {
        "values": {
          "string": [
            {
              "name": "splunk-host-name",
              "value": "={{ $json.body.inputs.A.key['host.name'].replace(/[^a-zA-Z0-9 ]/g, '') }}"
            }
          ]
        },
        "options": {}
      },
      "typeVersion": 2
    },
    {
      "id": "create-or-comment-jira-issues-for-splunk-alerts-4",
      "name": "IF Ticket Not Exists",
      "type": "n8n-nodes-base.if",
      "position": [
        20,
        320
      ],
      "parameters": {
        "conditions": {
          "string": [
            {
              "value1": "={{ $json.key }}",
              "operation": "isEmpty"
            }
          ]
        }
      },
      "typeVersion": 1
    },
    {
      "id": "create-or-comment-jira-issues-for-splunk-alerts-5",
      "name": "Sticky Note",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        -1120,
        -26.960531840248223
      ],
      "parameters": {
        "width": 643.8620281403546,
        "height": 537.944771288002,
        "content": "![VirusTotal](https://i.imgur.com/spMd6AQ.png)\n## Webhook Node \nTo setup your webhook integration for Splunk, first ensure that splunk is setup to send alerts to a webhook by visiting the [Setup Guide here](https://docs.splunk.com/observability/en/admin/notif-services/webhook.html). You will copy the n8n webhook url opening the webhook node below. \n- **Form Access URLs**:\n  - **Execute Mode**: `https://n8n.domain.com/webhook/test/webhookpath` - Use this to execute the workflow interactively within the n8n canvas. Hit the 'Execute Workflow' button to see real-time execution results. Send a test alert with the configured header and payload. \n  - **Silent Mode**: `https://n8n.domain.com/webhook/webhookpath` - Use this for background execution without canvas updates. Results will be logged silently and can be reviewed in the 'Executions' tab."
      },
      "typeVersion": 1
    },
    {
      "id": "create-or-comment-jira-issues-for-splunk-alerts-6",
      "name": "Create Ticket",
      "type": "n8n-nodes-base.jira",
      "position": [
        240,
        160
      ],
      "parameters": {
        "project": {
          "__rl": true,
          "mode": "id",
          "value": "YOUR_PROJECT_ID"
        },
        "summary": "=Splunk Alert for host {{ $('Set Host Name').item.json.body.inputs.A.key[\"host.name\"] }}:  {{ $('Set Host Name').item.json.body.description }}",
        "issueType": {
          "__rl": true,
          "mode": "id",
          "value": "YOUR_ISSUE_TYPE_ID"
        },
        "additionalFields": {
          "description": "={{ $('Set Host Name').item.json.body.description }}\n\n{{ $('Set Host Name').item.json.body.messageBody }}",
          "customFieldsUi": {
            "customFieldsValues": [
              {
                "fieldId": {
                  "__rl": true,
                  "mode": "id",
                  "value": "YOUR_CUSTOM_FIELD_ID"
                },
                "fieldValue": "={{ $('Webhook').item.json[\"body\"][\"inputs\"][\"A\"][\"key\"][\"host.name\"].replace(/[^a-zA-Z0-9 ]/g, '') }}"
              }
            ]
          }
        }
      },
      "typeVersion": 1
    },
    {
      "id": "create-or-comment-jira-issues-for-splunk-alerts-7",
      "name": "Sticky Note1",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        -460,
        98.72468966845895
      ],
      "parameters": {
        "width": 401.99970102055784,
        "height": 413.43480804607805,
        "content": "![VirusTotal](https://upload.wikimedia.org/wikipedia/commons/thumb/8/82/Jira_%28Software%29_logo.svg/320px-Jira_%28Software%29_logo.svg.png)\n## Normalize Hostname \nTo ensure no special characters are passed into jira and create issues, this set node removes special characters from the `splunk-host-name` and uses that to search and create tickets. This host name is saved as a custom field. "
      },
      "typeVersion": 1
    },
    {
      "id": "create-or-comment-jira-issues-for-splunk-alerts-8",
      "name": "Sticky Note2",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        180,
        -21.934709587377256
      ],
      "parameters": {
        "width": 401.99970102055784,
        "height": 348.38243930996134,
        "content": "![VirusTotal](https://upload.wikimedia.org/wikipedia/commons/thumb/8/82/Jira_%28Software%29_logo.svg/320px-Jira_%28Software%29_logo.svg.png)\n## Create a new ticket\nThis creates a new ticket in your Prjoect and issue type. Ensure to update these values to ensure it works correctly. "
      },
      "typeVersion": 1
    },
    {
      "id": "create-or-comment-jira-issues-for-splunk-alerts-9",
      "name": "Sticky Note3",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        180,
        340
      ],
      "parameters": {
        "width": 401.99970102055784,
        "height": 341.08777742613927,
        "content": "![VirusTotal](https://upload.wikimedia.org/wikipedia/commons/thumb/8/82/Jira_%28Software%29_logo.svg/320px-Jira_%28Software%29_logo.svg.png)\n## Add Ticket Comment\nThis adds the alert as a comment in the existing ticket, to ensure the data is not duplicated. "
      },
      "typeVersion": 1
    },
    {
      "id": "create-or-comment-jira-issues-for-splunk-alerts-10",
      "name": "Sticky Note4",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        -40,
        100.50445897107033
      ],
      "parameters": {
        "width": 193.6032856277124,
        "height": 415.27445353029793,
        "content": "## Check if ticket found\nThis checks `$json.key` to see if the value was found, and route accordingly."
      },
      "typeVersion": 1
    }
  ],
  "active": false,
  "pinData": {},
  "settings": {
    "executionOrder": "v1"
  },
  "connections": {
    "Webhook": {
      "main": [
        [
          {
            "node": "Set Host Name",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Search Ticket": {
      "main": [
        [
          {
            "node": "IF Ticket Not Exists",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Set Host Name": {
      "main": [
        [
          {
            "node": "Search Ticket",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "IF Ticket Not Exists": {
      "main": [
        [
          {
            "node": "Create Ticket",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "Add Ticket Comment",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}