> For the complete documentation index, see [llms.txt](https://docs.threatdefence.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.threatdefence.com/siem-integrations/software-as-a-service/atlassian-logs.md).

# Atlassian Audit Logs

#### Before you begin:

* Only users with **organization admin** privileges can generate org-level API keys and retrieve the Organization ID. This is included for all Atlassian products.
* The following credentials are required as deliverables.
* This integration collects audit log events across all Atlassian products in your organization: **Jira**, **Confluence**, **Bitbucket**, **Atlassian Guard Detect**, and **Loom**.
* You can onboard with a single product, and the integration will pick up the new products when permissions get added on.

***

#### **Step 1: Find your Organization ID**

1. **Log in to the Atlassian Admin Console**
   * Go to [https://admin.atlassian.com](https://admin.atlassian.com/).
   * Sign in with your organization admin account.
2. **Locate your Organization ID**
   * After logging in, select your organization from the list.
   * The **Organization ID** appears in the browser URL:\
     `https://admin.atlassian.com/o/<your_org_id>/...`\
     Copy the value between `/o/` and the next `/`.

***

#### **Step 2: Generate an Org-Level API Key**

1. **Navigate to API Keys**
   * From the Atlassian Admin Console ([admin.atlassian.com](https://admin.atlassian.com/)), go to **Settings** → **API keys**.
2. **Create a new API key**
   * Click **Create API key**.
   * Enter a descriptive name (e.g., `"ThreatDefence Audit Logs"`).
   * Add the `read:events:admin` scope to the API key.
   * Set an expiry date — note this date, as the key will need to be rotated before it expires.
   * Click **Create** and then **Copy** the API key immediately — it will not be shown again.

> **Important:** This is an organization-level API key (not a personal API token).
>
> It is generated under **Settings → API keys** in the Atlassian Admin Console, **not** under your personal Atlassian profile.

***

#### Onboarding the integration

Please follow the [Managing Integrations](/platform-management/managing-integrations.md) instructions and onboard the integration. The above saved credentailas are required in this process.

If encountered difficulties with onboarding, please email the following credentials to <support@threatdefence.com>

* Organization ID
* API Key


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.threatdefence.com/siem-integrations/software-as-a-service/atlassian-logs.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.