User Guide

Complete guide to using A9 Sightglass for comprehensive security auditing and compliance monitoring.

Understanding the Data

Two Modes of Operation

A9 Sightglass operates in two modes, each providing different levels of visibility:

Feature Forge Mode Only Enhanced with Org Enumerator
User & Group Analysis Jira instance level Organization level (all products)
Permission Mapping Project & site permissions Cross-product permissions
Security Policies Jira-specific settings Org-wide policies
Compliance Reporting Jira compliance Enterprise-wide compliance
Setup Required None (automatic) One-time configuration

Understanding Sankey Diagrams

Sankey diagrams visualize flows and relationships in your Atlassian environment:

Permission Flow Diagram

Shows how permissions cascade from organization → groups → users → projects:

  • Width of flows: Represents the number of users or permissions
  • Colors: Indicate different permission levels or roles
  • Interactive: Click nodes to drill down and explore details

User Hierarchy Diagram

Displays organizational structure and reporting relationships:

  • Levels: Organization → Business Units → Teams → Users
  • Connections: Show reporting lines and group memberships
  • Search: Filter to find specific users or groups
Tip: Use the search and filter controls above each diagram to focus on specific areas of interest.

Compliance Rules Configuration

Built-in Rule Categories

A9 Sightglass includes compliance rules for multiple frameworks:

Authentication & Access

  • Two-factor authentication enforcement
  • Password policy compliance
  • Session timeout settings
  • API token management

Authorization

  • Excessive admin permissions
  • Anonymous access
  • Guest user policies
  • Permission scheme best practices

Data Security

  • Public project detection
  • Sensitive data exposure
  • Issue security schemes
  • Attachment security

Compliance

  • Audit log retention
  • Data residency requirements
  • Privacy policy compliance
  • Industry standards (SOC 2, ISO 27001)

Customizing Rules

  1. Click the Settings icon in the dashboard
  2. Navigate to Compliance Rules tab
  3. Browse rules by category or search by name
  4. Toggle rules on/off based on your organization's needs
  5. Adjust severity levels (Critical, High, Medium, Low)
  6. Click Save Changes
  7. Trigger a new scan to apply updated rules
Important: Rule changes only apply to future scans. Re-scan your instance to see updated compliance results.

Report Generation

Report Types

Executive Summary PDF

High-level overview perfect for stakeholders and management:

  • Overall security score
  • Top 10 critical issues
  • Compliance status by framework
  • Trend analysis (if historical data available)

Detailed Analysis PDF

Comprehensive report for security teams:

  • Complete issue list with descriptions
  • Remediation steps for each finding
  • User and permission details
  • Configuration recommendations

Data Exports (CSV/JSON)

Raw data for further analysis:

  • User access matrix
  • Group membership lists
  • Permission mapping
  • Issue data with metadata

Custom Reports

Build reports tailored to your needs:

  1. Select specific data fields to include
  2. Choose data levels (L1-L5)
  3. Apply filters (severity, category, project)
  4. Generate in your preferred format

Org Enumerator Setup

Why Is This Needed?

Atlassian Organization APIs

Contains enterprise data, user directory, cross-product settings

⚠️ Not accessible from Forge sandbox

Forge App (A9 Sightglass)

Secure sandbox with access to Jira APIs only

✓ Solution

Org Enumerator Tool

Runs separately with API token to collect org data

Setup Instructions

Step 1: Generate API Token

  1. Go to id.atlassian.com/manage-profile/security/api-tokens
  2. Click "Create API token"
  3. Give it a descriptive name: "A9 Sightglass Org Enumerator"
  4. Copy the token (you won't see it again!)

Step 2: Download Org Enumerator

  1. Visit a9sightglass.io/org-enumerator.js
  2. Save the file to your local machine

Step 3: Configure and Run

node org-enumerator.js \
  --email your-email@company.com \
  --token YOUR_API_TOKEN \
  --org-id your-org-id

Step 4: Upload to A9 Sightglass

  1. The tool generates org-data.json
  2. In A9 Sightglass, go to Settings → Organization Data
  3. Click "Upload Org Data"
  4. Select the org-data.json file
  5. Trigger a new scan to see enhanced analysis
Best Practice: Run the org enumerator weekly or monthly to keep your analysis up to date with organization changes.

Troubleshooting

App shows black screen or won't load

  • Cause: Browser cache or Content Security Policy issues
  • Solution: Hard refresh your browser (Ctrl+Shift+R or Cmd+Shift+R)
  • If persistent, clear browser cache and cookies

Scan takes a long time or times out

  • Cause: Large Jira instance with many users/projects
  • Solution: Be patient - first scan can take 5-10 minutes for large instances
  • Subsequent scans use cached data and are much faster

No issues found / Empty dashboard

  • Cause: Compliance rules may be too strict or disabled
  • Solution: Check Settings → Compliance Rules and enable appropriate rules
  • Trigger a new scan after changing rules

Org Enumerator fails with 401/403 error

  • Cause: Invalid API token or insufficient permissions
  • Solution: Verify your API token is correct and hasn't expired
  • Ensure you have org admin permissions
  • Generate a new API token if needed

Reports won't generate or download

  • Cause: Browser popup blocker or permissions
  • Solution: Allow popups from your Atlassian domain
  • Check browser console for errors
  • Try a different report format (PDF vs CSV)
Still need help? Contact support at support@a9consulting.com with:
  • Your Jira site URL
  • Browser and version
  • Screenshot of the issue
  • Any error messages from browser console

Security & Privacy

Data Collection

A9 Sightglass collects only the data necessary for security analysis:

  • User and group information (names, emails, roles)
  • Permission schemes and configurations
  • Project settings and visibility
  • Issue metadata (no issue content)

Data Storage

  • Analysis results cached in Atlassian's secure Forge storage
  • No data sent to external servers
  • Org Enumerator data stays in your Forge environment
  • Cache automatically expires after 24 hours

Data Access

  • Only Jira administrators can access A9 Sightglass
  • Uses Atlassian's built-in authentication and authorization
  • No third-party access to your data
  • Complies with Atlassian Marketplace security requirements

Compliance

A9 Sightglass is designed to help you maintain compliance with:

  • SOC 2 Type II
  • ISO 27001
  • GDPR
  • HIPAA (when properly configured)
  • PCI DSS (payment processing environments)