Turn reported suspicious mail into Jira tickets
Opens a Jira ticket for each message your people report, and adds later reports of the same sender to the ticket already open.
What it does
Each integration step this workflow runs, in order, what it is for, and the conditions and loops that decide when it runs.
- 1GmailNew email triggerWakes the workflow when new mail arrives in Gmail, leaving the search to decide which messages count as reports.
- 2GmailList emailsFinds reported messages matching your search that do not yet carry the triaged label, up to a limit per run.
For each
message- 3JiraSearch issuesSearches your Jira project for a ticket whose title carries the sender address marker, to find one already open.
If
openTicketis not empty- 4JiraAdd commentAdds the report as a comment on the open ticket when the same sender has already been reported.
Otherwise
- 5JiraCreate issueOpens a ticket titled with the sender marker and subject, its description copied line by line from the message.
- 4
- 6GmailAdd label to messageApplies the triaged label to the message only after its ticket or comment has been written, creating the label if needed.
- 3
How it works
What happens on each run, in plain English.
Whenever new mail arrives in Gmail, the messages your people have reported as suspicious are found by a search you choose, and each one becomes a ticket in the Jira project your responders already work from.
Every line of the ticket is copied from the message: the sender address, the name shown, whether that address is on one of your own domains, the subject, the hosts its links point to and the Gmail message id. Nothing is rated or scored: a conclusion would be invention. It does note when a name you list as commonly impersonated appears in the sender name or subject while the address is not yours, and it records only the host part of each link. One ticket per sender, not per report: later reports of the same sender become comments on the ticket already open. A message is labelled as triaged only after its ticket is written, so a failed run repeats a report rather than losing it.
You need a Gmail label or search that identifies reported mail and a Jira project for the tickets.
You may also be interested in
Flag emails that link to unfamiliar websitesPosts to Slack when new mail links to a site outside your expected list, with how recently that site was registered and who runs it.
Record where incoming emails really came fromFor the emails your Gmail search picks out, logs whether each passed the sender checks and which servers it really came through.
Check your websites' security settings every weekEach Monday, checks the sites you list for the browser protections they should switch on, and emails what is missing and how to fix it.Watch your websites for downtimeChecks every site listed in a spreadsheet on a schedule and alerts you in Slack or by email when one goes down or recovers.Start from a workflow that already works.
Add "Turn reported suspicious mail into Jira tickets" to your workspace, connect its apps, and make it yours.
Free plan, no credit card