Solutions/AtlassianJiraAudit/Hunting Queries/JiraBlockedTasks.yaml

id: 3fdc31f0-a166-4a4d-b861-f3cd262fd4a1
name: Jira - Blocked tasks
description: |
  'Query searches for blocked tasks.'
severity: Medium
requiredDataConnectors:
  - connectorId: JiraAuditAPI
    dataTypes:
      - JiraAudit
tactics:
  - Impact
relevantTechniques:
  - T1499
query: |
  JiraAudit
  | where TimeGenerated > ago(24h)
  | where EventMessage in ('Status updated', 'Status created')
  | where ObjectItemTypeName =~ 'STATUS'
  | where ObjectItemName =~ 'Blocked'
  | extend ProcessCustomEntity = ObjectItemName
entityMappings:
  - entityType: Process
    fieldMappings:
      - identifier: ProcessId
        columnName: ProcessCustomEntity