Atlassian says it can't tell you whether an instance was hit, so check every node's access logs (and any reverse proxy or WAF in front) back to at least Oct 5, when the advisory and fixes went out. Per the advisory: URL-decode each request line up to twice, then look for .. directly next to /, \ or ::; or run Atlassian's regex over the raw lines. Pay attention to unauthenticated requests that got a 200 response, unusual source IPs, and requests aimed at config or credential files in the webapp root. If you find hits, assume any secrets those files held are exposed and rotate them, even after patching.

# Atlassian's published pattern (raw or decoded URI)
(?is).*(?:/|\\|::|%(?:25)*(?:2f|5c)|(?::|%(?:25)*3a){2})(?:\.|%(?:25)*2e){2}(?:/|\\|::|%(?:25)*(?:2f|5c)|(?::|%(?:25)*3a){2}|;|%(?:25)*3b|$).*
# e.g. grep -P over access_log*, then filter status 200 and no session cookie