Slack & Jira Workflows

Why Notification Workflows Matter

A pentest that discovers critical vulnerabilities is only as valuable as the speed of your response. If findings sit unread in a dashboard for days, the window of exposure remains open. Notification workflows ensure the right people are alerted the moment findings are available, and ticketing integrations ensure remediation is tracked to completion.

TurboPentest integrates with Slack for completion alerts and Jira for structured remediation tracking. Both are configured in Settings > Integrations and fire automatically when a pentest finishes.

Slack Integration

Setting Up Slack Notifications

TurboPentest supports two ways to deliver Slack notifications:

1. Slack app (recommended) - Connect the TurboPentest Slack app via OAuth and pick the channel to post to. Messages are sent through Slack's API with a bot token.
2. Incoming webhook - Create a Slack app at api.slack.com/apps, enable Incoming Webhooks, add a webhook to your target channel (e.g., #security-alerts), and paste the https://hooks.slack.com/... URL into Settings > Integrations > Slack.

Use the built-in connection test after saving - TurboPentest posts a test message to confirm delivery.

Notification Events

Slack notifications fire for:

• Pentest Complete - A summary message with the target, total findings, counts by severity (critical, high, medium, low, info), up to five of the critical and high findings with CVSS scores, and a "View Full Report" button
• Pentest Failed - An alert when a pentest times out or errors before completing, so you can re-run it
• Asset changes - For connected cloud providers, alerts when new resources appear (not yet verified), when previously verified assets disappear, and when a provider connection breaks
• Compliance digest - An optional weekly digest summarizing in-scope, tested, overdue, and scheduled assets for your compliance framework

Notification Format

The pentest-complete message uses rich Slack Block Kit formatting:

• Header with the target hostname
• Severity counts ordered critical, high, medium, low, info
• Up to five critical/high findings with title and CVSS score
• A "View Full Report" button linking directly to the report

Jira Integration

Setting Up Jira Ticket Creation

TurboPentest can automatically create Jira tickets for findings, ensuring every vulnerability enters your remediation workflow:

1. Generate a Jira API Token - In your Atlassian account settings, create an API token for TurboPentest.
2. Configure in TurboPentest - Go to Settings > Integrations > Jira. Enter your Jira Cloud instance URL, account email, API token, and project key. TurboPentest authenticates with basic auth (email + API token) against the Jira Cloud REST API v3.
3. Choose a ticket mode and threshold - Pick per-finding or summary mode, and set the minimum severity that creates tickets.

Automatic Ticket Creation

When a pentest completes, TurboPentest creates Jira issues (type Bug) for findings that meet your minimum severity threshold. Two modes are available:

• Per-finding mode (default) - One ticket per qualifying finding. The summary is [TurboPentest] <finding title>, and the description includes the CVSS score and vector, CWE, OWASP category, CVEs, full description, proof of exploit, remediation steps, and a link back to the report. Labels: turbopentest plus the finding's severity.
• Summary mode - A single ticket per pentest listing all qualifying findings by severity, labeled turbopentest, with priority taken from the highest severity present. Useful for teams that triage in Jira and split tickets themselves.

Priority mapping - TurboPentest severity maps to Jira priority: Critical = Highest, High = High, Medium = Medium, Low = Low, Info = Lowest.

Controlling Ticket Volume

The integration creates tickets from each completed pentest independently - it does not currently deduplicate against tickets from earlier runs. To keep volume manageable:

• Set the minimum severity to high initially, lowering it as your remediation process matures
• Use summary mode for frequently pentested targets so each run produces at most one ticket
• Use TurboPentest's finding continuity statuses (new, confirmed, retest_confirmed) in the dashboard to focus Jira grooming on genuinely new findings

Testing the Connection

Settings > Integrations includes a test action for Jira that verifies your credentials can reach the configured project before any real tickets are created.

Managing Integrations via API

Both integrations can also be managed programmatically:

GET  /api/integrations          # list configured integrations
POST /api/integrations          # create or update (type: slack | jira, plus config)
POST /api/integrations/test     # send a test message / verify project access

For Slack the config is the webhook URL (or the app connection handles it for you); for Jira it is the instance URL, project key, email, API token, ticket mode, and minimum severity.

Best Practices

Pick the right channel. Send notifications to a channel your security or engineering team actually watches - a dedicated #security-alerts channel beats a noisy general channel.

Set Jira thresholds appropriately. Creating tickets for every informational finding creates noise. Start with high and above, and lower the threshold as your team's remediation process matures.

Use summary mode for recurring pentests. Scheduled weekly pentests in per-finding mode can re-ticket recurring findings; summary mode keeps each run to one ticket.

Test after configuring. Always run the built-in connection test so the first real critical finding does not disappear into a misconfigured webhook.