Jira Integration

Orcho integrates directly with Jira to automatically assess the risk of every ticket as it’s created. Get real-time risk scores and recommendations before work begins, helping teams prioritize security reviews and prevent high-risk implementations.

Features

Automatic Assessment

Risk assessment runs automatically on ticket creation

Smart Warnings

High-risk tickets are flagged immediately with clear warnings

Team Visibility

Risk scores visible to entire team in ticket metadata

Workflow Integration

Block or require approval for critical-risk tickets

How It Works

When a developer creates a Jira ticket, Orcho automatically:

Ticket created

Developer creates a new Jira ticket with title and description

Orcho analyzes

The Orcho app intercepts the creation event and calls the assess_risk API with the ticket content

Risk assessment returned

Orcho evaluates the ticket for:

Data sensitivity
Input clarity
Potential blast radius
Security concerns

Risk displayed

Risk score and level are added as custom fields on the ticket:

Risk Score: 0.72
Risk Level: HIGH
Recommendations: Review required before implementation

Team notified

For high-risk tickets (≥ 0.6), stakeholders are automatically notified

Installation

Install Orcho for Jira

Visit the Atlassian Marketplace and search for “Orcho Risk Assessment”

Or have your Jira admin install from the Apps section

Contact for API key

Email [email protected] to request an API key for your organization

Configure the app

In Jira, go to:

Settings → Apps → Manage Apps
Find “Orcho Risk Assessment”
Click “Configure”
Enter your API key
Save configuration

Enable for projects

Choose which Jira projects should have automatic risk assessment:

Settings → Apps → Orcho Configuration
Select projects to enable
Configure risk thresholds (optional)
Save changes

Test the integration

Create a test ticket with a high-risk description:

Title: Delete all production user data
Description: Remove all users from the production database to clean up old accounts

Verify that the risk assessment appears on the ticket

Risk Assessment Fields

Orcho adds the following custom fields to your Jira tickets:

Orcho Risk Score

number

Overall risk score from 0.0 (minimal risk) to 1.0 (critical risk)Example: 0.72

Orcho Risk Level

string

Risk level category: minimal, low, medium, high, or criticalExample: HIGH

Orcho Risk Factors

object

Breakdown of individual risk factor scoresExample:

Data Sensitivity: 0.85
Input Clarity: 0.62
Blast Radius: N/A (no context)

Orcho Recommendations

array

Actionable recommendations for mitigating riskExample:

Add WHERE clause to limit scope
Require security team approval
Create backup before deletion

Orcho Assessment Date

datetime

Timestamp when risk assessment was performedExample: 2026-01-08T14:30:00Z

Example Risk Assessment

High-Risk Ticket

JIRA-1234: Delete inactive user accounts

Risk Assessment:
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
⚠️  HIGH RISK (Score: 0.78)

Risk Factors:
• Data Sensitivity: 0.92 (CRITICAL)
• Input Clarity: 0.68 (HIGH)
• Blast Radius: 0.65 (HIGH)

Recommendations:
• REVIEW_REQUIRED - Significant risk factors present
• Add specific criteria for "inactive" (e.g., no login > 90 days)
• Implement soft delete instead of hard delete
• Require manual approval from security team
• Create full database backup before execution
• Test on staging environment first

⚠️  This ticket has been flagged for security review
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Low-Risk Ticket

JIRA-1235: Update button color on homepage

Risk Assessment:
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
✓  LOW RISK (Score: 0.18)

Risk Factors:
• Data Sensitivity: 0.05 (MINIMAL)
• Input Clarity: 0.25 (LOW)
• Blast Radius: 0.15 (MINIMAL)

Recommendations:
• SAFE - Minimal risk detected
• Proceed with standard development workflow

✓  This ticket is safe to implement
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Workflow Automation

Automatic Approvals

Configure Jira workflows to require approvals based on risk:

High Risk (≥ 0.6)
Critical Risk (≥ 0.8)
Low Risk (< 0.4)

Require approval from:

Security team lead
Engineering manager
Product owner

Workflow:

Ticket created → Risk assessed
If risk ≥ 0.6 → Status changes to “Security Review”
Security team notified automatically
Requires approval before moving to “In Progress”

Configuration Options

Risk Thresholds

Customize thresholds for your organization:

warning_threshold

number

default:"0.6"

Risk score that triggers warnings and notificationsDefault: 0.6 (high risk)

blocking_threshold

number

default:"0.8"

Risk score that blocks ticket from moving to developmentDefault: 0.8 (critical risk)

auto_approve_threshold

number

default:"0.4"

Risk score below which tickets are auto-approvedDefault: 0.4 (medium risk)

Notification Settings

notify_high_risk

boolean

default:"true"

Send notifications for high-risk tickets (≥ 0.6)

notify_critical_risk

boolean

default:"true"

Send notifications for critical-risk tickets (≥ 0.8)

notification_channels

array

Where to send notifications: email, slack, jira-commentDefault: ["email", "jira-comment"]

notification_recipients

object

Who receives notifications for each risk levelExample:

{
  "high_risk": ["[email protected]"],
  "critical_risk": ["[email protected]", "[email protected]"]
}

JQL Queries

Use Jira Query Language to find tickets by risk level:

Find High-Risk Tickets

"Orcho Risk Level" = "HIGH" OR "Orcho Risk Level" = "CRITICAL"

Find Tickets Needing Review

"Orcho Risk Score" >= 0.6 AND status = "Security Review"

Find Safe-to-Implement Tickets

"Orcho Risk Level" IN ("MINIMAL", "LOW") AND status = "Ready for Development"

Find Tickets by Risk Factor

"Orcho Risk Factors" ~ "Data Sensitivity: 0.9*"

Dashboards & Reports

Risk Distribution Dashboard

Create a dashboard showing:

Total tickets by risk level (pie chart)
Risk score distribution (histogram)
Average risk score trend over time (line chart)
High-risk tickets by assignee (bar chart)

Security Review Board

Track tickets requiring security review:

Pending security reviews
Average time in security review
Approval vs rejection rate
Most common high-risk patterns

Troubleshooting

Risk assessment not appearing

Check app installation:

Go to Settings → Apps → Manage Apps
Verify “Orcho Risk Assessment” is installed
Check that app is enabled

Verify API key:

Settings → Apps → Orcho Configuration
Ensure API key is entered correctly
Test connection with “Test API Key” button

Check project settings:

Verify risk assessment is enabled for this project
Check that user has permission to view custom fields

API key errors

Invalid API Key:

Contact [email protected] to verify key
Check for extra spaces or special characters
Try regenerating the key

Rate Limits:

Contact [email protected] to check quota
Upgrade plan if needed for higher volume

Connection Errors:

Verify Jira can reach app.orcho.ai
Check firewall/proxy settings
Contact IT to whitelist Orcho API

Incorrect risk scores

Update ticket for reassessment:

Edit ticket title or description
Save changes
Risk will be reassessed automatically

Manual reassessment:

Click “More” (•••) on ticket
Select “Reassess Risk” from Orcho menu
New assessment will replace old one

Adjust risk thresholds:

Settings → Apps → Orcho Configuration
Customize thresholds for your needs
Save and test with sample tickets

Notifications not working

Check notification settings:

Settings → Apps → Orcho Configuration
Verify notification channels are enabled
Check recipient email addresses

Test notifications:

Create a test high-risk ticket
Check spam folders
Verify Slack webhook is configured correctly

Permission issues:

Ensure recipients have access to project
Check Jira notification scheme settings

Best Practices

Start with monitoring mode

Enable for 1-2 projects initially to tune thresholds before org-wide rollout

Train your team

Educate developers on:

How risk assessment works
What different risk levels mean
How to write safer ticket descriptions

Review blocked tickets

Hold weekly reviews of blocked tickets to:

Understand common high-risk patterns
Adjust thresholds if needed
Improve ticket writing practices

Integrate with existing workflows

Don’t create parallel workflows - integrate risk assessment into existing approval processes

Monitor and iterate

Track metrics:

False positive rate (safe tickets marked high-risk)
False negative rate (risky tickets marked low-risk)
Time spent in security review
Developer feedback

Advanced Features

Custom Risk Weights

Adjust risk factor weights based on your organization’s priorities:

{
  "data_sensitivity": 0.40,
  "input_clarity": 0.30,
  "blast_radius": 0.20,
  "legal_ip_risk": 0.10
}

Configure in: Settings → Apps → Orcho Configuration → Risk Weights

Jira Automation Rules

Create automation rules triggered by risk assessment: Example: Auto-assign high-risk tickets

Trigger: Issue Created
Condition: Orcho Risk Level = "HIGH" OR "CRITICAL"
Action: Assign to Security Team

Example: Add label for tracking

Trigger: Issue Created
Condition: Orcho Risk Score >= 0.6
Action: Add label "security-review-required"

Example: Update priority

Trigger: Issue Created  
Condition: Orcho Risk Level = "CRITICAL"
Action: Set Priority = Highest

Integration with Other Tools

Slack Notifications

Connect Orcho risk assessments to Slack:

Install Jira for Slack
Configure webhook in Orcho settings
Get notifications in #security-alerts channel
Include risk score and direct link to ticket

Confluence Documentation

Automatically create security review docs:

High-risk ticket created
Orcho creates Confluence page with risk details
Security team adds review notes
Link back to Jira ticket

Support

Need help with the Jira integration?

Install App

Find us on Atlassian Marketplace

Get API Key

API Documentation

Review the REST API docs

Email Support

Contact support team

Next Steps

Install the Jira app

Search for “Orcho” in Atlassian Marketplace

Get your API key

Contact [email protected]

Configure risk thresholds

Set thresholds that match your security policy

Enable for pilot project

Start with one project to tune settings

Train your team

Help developers understand risk assessment

Roll out organization-wide

Expand to all projects once validated

​Features

Automatic Assessment

Smart Warnings

Team Visibility

Workflow Integration

​How It Works

​Installation

​Risk Assessment Fields

​Example Risk Assessment

​High-Risk Ticket

​Low-Risk Ticket

​Workflow Automation

​Automatic Approvals

​Configuration Options

​Risk Thresholds

​Notification Settings

​JQL Queries

​Find High-Risk Tickets

​Find Tickets Needing Review

​Find Safe-to-Implement Tickets

​Find Tickets by Risk Factor

​Dashboards & Reports

​Risk Distribution Dashboard

​Security Review Board

​Troubleshooting

​Best Practices

​Advanced Features

​Custom Risk Weights

​Jira Automation Rules

​Integration with Other Tools

​Slack Notifications

​Confluence Documentation

​Support

Install App

Get API Key

API Documentation

Email Support

​Next Steps

Features

How It Works

Installation

Risk Assessment Fields

Example Risk Assessment

High-Risk Ticket

Low-Risk Ticket

Workflow Automation

Automatic Approvals

Configuration Options

Risk Thresholds

Notification Settings

JQL Queries

Find High-Risk Tickets

Find Tickets Needing Review

Find Safe-to-Implement Tickets

Find Tickets by Risk Factor

Dashboards & Reports

Risk Distribution Dashboard

Security Review Board

Troubleshooting

Best Practices

Advanced Features

Custom Risk Weights

Jira Automation Rules

Integration with Other Tools

Slack Notifications

Confluence Documentation

Support

Next Steps