NG SIEM - (Plain Scope) Atlassian Confluence Integration

What is API Token?

A secure string used to authenticate external applications or scripts so they can access Confluence’s REST APIs without needing a user password. Its main use is to allow programmatic access for integrations, automation, or tools to interact with Confluence content.

Creating an API Token

Follow these steps to create a token. Note: As of March 13, 2025, tokens created before December 15, 2024, will expire between March 14 and May 12, 2026. New tokens default to 1-year expiration (adjustable from 1 to 365 days).

Log in to https://id.atlassian.com/manage-profile/security/api-tokens.
Select "Create API token".
Enter a descriptive name for the token (e.g., "AQUILA- Audit Logs Monitoring").
Choose an expiration date for the token (between 1 and 365 days; consider shorter for security).
Click "Create".
Copy the token and save it securely. You cannot view it again after this step. If lost, generate a new one. Share only with trusted integrations like AQUILA—revoke if compromised.

Required Atlassian-Side Permissions

The user account tied to the email (Jira/Confluence User Identifier) must have admin-level access to fetch audit logs via API:

For Confluence: Confluence Global permission.
https://your-domain.atlassian.net/wiki/admin/permissions/global?tab=internal
The confluence-admins-ronaldoa both Personal Space and Create Space should be checked. Click the "Edit" to proceed.

For Confluence: Confluence Administration permission.
https://admin.atlassian.com/o/8d1afe09-e60a-4bf3-87d9-c71b10e4842b/atlassian-apps
Click "Manage app".

Provide Role App admin, User access admin, user in confluence-admins-ronaldoa.

In Groups under by Directory, make sure the User is active.

Without this, the API may authenticate successfully (leading to a "healthy" status in AQUILA) but return no data or errors like 403 Forbidden. If you lack access to the client side, request they verify/add these permissions via admin.atlassian.com > Global Permissions.

Note: If you're on a Free plan without org access, you can't enable advanced features—consider upgrading or using site-level logs in individual apps.

Required Credentials for Integration Access (AQUILA Setup)

Use these in AQUILA > Integrations > Atlassian Jira/Confluence setup (separate integrations for each). For Atlassian Cloud, authentication uses Basic Auth (email + token).

API URL: Base Atlassian API URL without paths (e.g., https://your-site.atlassian.net for Confluence; add /wiki for Confluence endpoints if needed, but AQUILA handles this).
User Identifier: Your Atlassian email address (must be linked to an admin account as noted above).
API Token: The scoped token created above.
Personal Access Token (PAT) - : The Personal Access Token used for self-hosted instances. If set, Jira User Identifier and Jira API Token will be ignored. (Optional)

For self-hosted (Data Center/Server) instances, a Personal Access Token may be used instead, but Cloud setups prefer the API token.

Please provide the following information to CyTech

API URL: Base Atlassian API URL without paths (e.g., https://your-site.atlassian.net for Jira; add /wiki for Confluence endpoints if needed, but AQUILA handles this).
Confluence User Identifier: Your Atlassian email address (must be linked to an admin account as noted above).
Confluence API Token: The scoped token created above.