Vulnerability Response Integration with Atlassian Jira Approval workflow being overriden

[Greg33]

Hello community,

I'm currently implementing the Vulnerability Response Integration with Atlassian Jira integration for a customer. however I'm facing a rather bothering issue when it comes to state mapping.

Within the ServiceNow platform, we have put False positive and Exception request approval rules in place, which as standard, update the Remediation tasks state to: In review / Closed / deferred accordingly.

As per the Agile tool state mapping('sn_vul_agile_tool_state_mapping') : The state will only be synchronised from ServiceNow to Agile tool if the entity state is Closed in ServiceNow or if any entity is Reopened (i.e. State is Open). All other states will be reflected from Agile tool to ServiceNow.

Therefore, this is resulting in a flapping scenarios where:

- ServiceNow's Remediation task is moved to In review (pending approval)

Jira is overriding this state, and moving us back to a previous state, meaning that we lose visibility over the approval request

- OR in the event that ServiceNow validate an exception request:

- ServiceNow's Remediation task is moved to Deferred (exception)

Jira again overrides this state and moves us back to the previous state, losing visibility and tracking of the exceptions that have been approved

I'd appreciate any feedback on this issue, and what steps you may have taken to avoid this flapping? It appears to be the 'intended' logic of the integration but it seems flawed.

[kmohammed]

You are reading the mapping correctly — this is the intended direction logic of the integration, not a fault in your approval rules, and that is exactly why it flaps.

Under sn_vul_agile_tool_state_mapping, ServiceNow only pushes state to Jira when the entity is Closed or Reopened (Open). Every other state is pulled from Jira into ServiceNow. So as soon as an approval moves a Remediation Task to In review, or a validated exception moves it to Deferred, that state is never sent to Jira — and on the next inbound sync, Jira's older status overwrites it back to the previous state. The approval outcome is then lost from the task, even though the approval record itself still exists.

There is no out-of-the-box mapping setting that fixes this, because In review and Deferred are intermediate, ServiceNow-only states in this design. Two workable approaches:

1. Keep the task out of an unsynced state while it is linked to Jira. Run the False Positive / Exception approval on the VIT or exception record, and only let the Remediation Task move to its final state (Closed for an accepted False Positive, Deferred for an approved exception) once the decision is final — or pause the Jira link for that task while approval is pending and re-sync it after the decision. This avoids the overwrite without changing the integration.

2. If the business needs In review and Deferred to be visible in Jira, customize the sync, not the approval rules: either extend the outbound mapping so those states have a matching Jira status to push to, or add a guard to the inbound sync that skips a Jira-driven state change while the task is in In review or Deferred with a pending approval. Treat that as a customization to the integration logic — test it in a sub-production instance and re-check it after any VR/Jira integration upgrade, since it changes the shipped sync behavior.

In short: do not try to fix this by changing the approval rules. Either keep approval states off the synced task until the decision is final, or guard the inbound sync for those states.