Skip to main content

Wiz

Wiz is a cloud security tool that scans your cloud environments to provide complete visibility into every technology running in your cloud. You can bring virtual network, virtual machine, vulnerability and more data from Wiz into Brinqa to construct a unified view of your attack surface and strengthen your cybersecurity posture.

This document details the information you must provide for the connector to authenticate with Wiz when the data integration runs, and how to obtain that information from Wiz. See create a data integration for step-by-step instructions on setting up the integration.

Required connection settings

When setting up a data integration, select Wiz from the Connector drop-down. If you cannot find the connector in the drop-down, make sure that you have installed it first. You must provide the following information to authenticate Wiz with Brinqa:

  • API URL: The Wiz API endpoint URL. The default URL is https://api.<region>.app.wiz.io.

  • Token URL: The Wiz API authentication token URL. The URL is specific to the identity provider (IdP) for the Wiz service account. See Table 1 for more information.

  • OAuth audience: The audience of your OAuth token. The audience is specific to your IdP. See Table 1 for more information.

  • Client ID and Client secret: The credentials associated with the Wiz service account, which must have permissions to log in to the API server and return data.

The Token URL and OAuth audience values depend on the IdP you use for the Wiz service account. The following table summarizes the different values:

Table 1. Wiz token URL and audience values

IdPToken URLAudience
Amazon Cognitohttps://auth.app.wiz.io/oauth/tokenwiz-api
Auth0https://auth.wiz.io/oauth/tokenbeyond-api

Obtain the client ID and client secret from Wiz

For the Wiz connector to use the Wiz API, you must provide the client ID and client secret from an active Wiz service account. To obtain the client ID and client secret, follow these steps:

  1. Log in to your organization's Wiz Portal as a Global Admin.

  2. Navigate to Settings > Service Accounts and click Add Service Account.

  3. Enter a name for the service account and select the following permissions:

    • read:resources

    • read:cloud_accounts

    • read:issues

    • read:reports

    • read:vulnerabilities

    • read:cloud_configuration

    • create:reports

    • read:security_scans

      create:reports permission

      The create:reports permission is required for the following reasons:

      1. The Wiz connector was developed in collaboration with Wiz and adheres to their recommended solutions. It has been certified by Wiz to ensure optimal functionality and security.
      2. Due to limitations with GraphQL in exporting large datasets, the connector generates reports in CSV format.
      3. The Wiz connector generates one report per asset type for Vulnerabilities, with each report prefixed by BRINQA-VULNERABILITIES-REPORT_.
      4. It also generates one report per inventory type for Inventory, with each report prefixed by BRINQA-INVENTORY-REPORT_. This lets you easily identify and monitor said reports.
      5. These reports are automatically deleted from Wiz based on your specified data cleanup frequency.
  4. Click Add Service Account.

    The new client ID and client secret display. You cannot view the client secret again. Copy and save them to a secure location.

note

Consult Wiz documentation for accuracy. If you do not have the permissions to create a service account, contact your Wiz administrator.

Additional settings

The Wiz connector contains additional options for specific configuration:

  • Page size: The maximum number of records to get per API request. The default setting is 100. It is not recommended to go over 100.

  • Maximum retries: The maximum number of times that the integration attempts to connect to the Wiz API before giving up and reporting a failure. The default setting is 5.

Types of data to retrieve

The Wiz connector can retrieve the following types of data from the Wiz API:

Table 2: Data retrieved from Wiz

Connector ObjectRequiredMaps to Data Model
Backup ServiceNoNot mapped
BucketNoNot mapped
CI/CD ServiceNoNot mapped
Compute Instance GroupNoNot mapped
ContainerYesContainer
Container ImageYesContainer Image
Container RegistryNoNot mapped
Container ServiceNoNot mapped
Daemon SetNoNot mapped
Database ServerYesDatabase Instance
DeploymentNoNot mapped
Encryption KeyNoNot mapped
File System ServiceNoNot mapped
FirewallNoNot mapped
IssueYesViolation
Issue DefinitionYesViolation Definition
Kubernetes ClusterNoNot mapped
Raw Access PolicyNoNot mapped
Resource GroupNoNot mapped
ServerlessYesServerless
Storage AccountNoNot mapped
SubscriptionNoNot mapped
Virtual MachineYesHost
Virtual Machine ImageYesHost Image
Virtual NetworkYesNetwork Segment
VulnerabilityYesVulnerability
Vulnerability DefinitionYesVulnerability Definition
Web ServiceNoNot mapped
info

For detailed steps on how to view the data retrieved from Wiz in the Brinqa Platform, see How to view your data.

Operation options

The Wiz connector supports the following operation options. See connector operation options for information about how to apply them.

Click the tabs below to view the supported operation options per connector object.

Table 3: Operation options

Connector ObjectOptionAll Possible ValuesDescriptionExample
Backup Service,
Bucket,
CI/CD Service,
Compute Instance Group,
Container,
Container Image,
Container Registry,
Container Service,
Daemon Set,
Database Server,
Deployment,
Encryption Key,
File System Service,
Firewall,
Kubernetes Cluster,
Raw Access Policy,
Resource Group,
Serverless,
Storage Account,
Subscription,
Virtual Machine,
Virtual Machine Image,
Virtual Network,
Web Service
projectIdAny number identifying a project.Filter reports associated with the specified project ID.Key: projectId,
Value: 1234.
This key and value combination only retrieves data from project ID 1234.
reportNameAny name identifying a report.Filter reports matching the specified name.Key: reportName,
Value: Report A.
This key and value combination only retrieves data from Report A.
note

The option keys and possible values are case-sensitive as they are shown in this documentation.

APIs

The Wiz connector uses the Wiz API. Specifically, it executes the following GraphQL queries to retrieve data:

Table 4: Wiz API GraphQL queries

Connector ObjectGraphQL Query
Backup ServiceReports GraphQL queries
BucketReports GraphQL queries
CI/CD ServiceReports GraphQL queries
Compute Instance GroupReports GraphQL queries
ContainerReports GraphQL queries
Container ImageReports GraphQL queries
Container RegistryReports GraphQL queries
Container ServiceReports GraphQL queries
Daemon SetReports GraphQL queries
Database ServerReports GraphQL queries
DeploymentReports GraphQL queries
Encryption KeyReports GraphQL queries
File System ServiceReports GraphQL queries
FirewallReports GraphQL queries
IssueIssue GraphQL queries
Issue DefinitionIssue GraphQL queries
Kubernetes ClusterReports GraphQL queries
Raw Access PolicyReports GraphQL queries
Resource GroupReports GraphQL queries
ServerlessReports GraphQL queries
Storage AccountReports GraphQL queries
SubscriptionReports GraphQL queries
Virtual MachineReports GraphQL queries
Virtual Machine ImageReports GraphQL queries
Virtual NetworkReports GraphQL queries
VulnerabilityReports GraphQL queries
Vulnerability GraphQL query
Vulnerability DefinitionReports GraphQL queries
Vulnerability GraphQL query
Vulnerability Definition GraphQL query
Web ServiceReports GraphQL queries

Issue GraphQL queries

The following query retrieves information about issue and issue definition:

query issueFindings($filterBy: IssueFilters, $first: Int, $after: String $orderBy: IssueOrder) {  
page: issuesV2(filterBy: $filterBy, first: $first, after: $after, orderBy: $orderBy) {
nodes {
id
status
severity
type
openReason
resolutionReason
suggestions
resolvedAt
createdAt
updatedAt
dueAt
statusChangedAt
rejectionExpiredAt
sourceRule {
__typename
... on Control {
id
name
description
severity
resolutionRecommendation
securitySubCategories {
id
title
category {
id
name
framework {
id
name
}
}
}
}
... on CloudEventRule {
id
name
description
sourceType
type
cloudEventRuleSeverity: severity
securitySubCategories {
id
title
category {
id
name
framework {
id
name
}
}
}
}
... on CloudConfigurationRule {
id
name
description
remediationInstructions
serviceType
severity
securitySubCategories {
id
title
category {
id
name
framework {
id
name
}
}
}
}
}
entity: entitySnapshot {
id
type
nativeType
name
status
cloudPlatform
cloudProviderURL
providerId
region
resourceGroupExternalId
subscriptionExternalId
subscriptionName
subscriptionTags
tags
externalId
}
projects {
id
name
description
slug
businessUnit
riskProfile {
businessImpact
}
}
serviceTickets {
id
externalId
name
url
}
notes {
id
createdAt
updatedAt
text
user {
id
name
email
}
serviceAccount {
id
name
type
}
}
}
pageInfo {
hasNextPage
endCursor
}
}
}

Reports GraphQL queries

The first query retrieves data for the Backup Service, Bucket, CI/CD Service, Compute Instance Group, Container, ContainerImage, Container Registry, Container Service, Daemon Set, Database Server, Deployment, Encryption Key, File System Service, Firewall, Kubernetes Cluster, Raw Access Policy, Resource Group, Serverless, Storage Account, Subscription, Virtual Machine Image, Virtual Network, Vulnerability, Vulnerability Definition, or Web Service connector objects from the reports endpoint. The rest of the queries create a report and generates the URL to download the report:

query ReportsSearch($filterBy: ReportFilters, $first: Int, $after: String) {
page: reports(first: $first, after: $after, filterBy: $filterBy) {
nodes {
id
name
createdBy {
id
email
}
lastRun {
id
runAt
}
lastSuccessfulRun {
id
runAt
}
type {
id
name
}
}
pageInfo {
hasNextPage
endCursor
}
}
}

mutation CreateReport($input: CreateReportInput!) {
operation: createReport(input: $input) {
node: report {
id
}
}
}

mutation RerunReport($reportId: ID!) {
operation: rerunReport(input: {id: $reportId}) {
node: report {
id
}
}
}

query ReportDownloadUrl($reportId: ID!) {
node: report(id: $reportId) {
id
name
lastRun {
id
url
status
}
}
}

Vulnerability GraphQL query

The following query retrieves information about vulnerabilities:

query vulnerabilityFindings($filterBy: VulnerabilityFindingFilters, $first: Int, $after: String) {  
page: vulnerabilityFindings(filterBy: $filterBy, first: $first, after: $after) {
nodes {
id
name
detailedName
CVEDescription
CVSSSeverity
vendorSeverity
score
exploitabilityScore
impactScore
description
remediation
link
locationPath
detectionMethod
version
fixedVersion
portalUrl
firstDetectedAt
lastDetectedAt
vulnerableAsset {
... on VulnerableAssetBase {
id
providerUniqueId
type
name
}
}
}
pageInfo {
hasNextPage
endCursor
}
totalCount
}
}

Vulnerability Definition GraphQL query

The following query retrieves information about vulnerability definition:

query VulnerabilityDefinitions($filterBy: VulnerabilityFilters, $first: Int, $after: String) { 
page: vulnerabilities(filterBy: $filterBy, first: $first, after: $after) {
nodes {
affectedTechnologies {
id
name
}
baseScore
cisaKevDueDate
cisaKevReleaseDate
cvssv2 {
attackComplexity
attackVector
confidentialityImpact
integrityImpact
privilegesRequired
userInteractionRequired
}
cvssv3 {
attackComplexity
attackVector
confidentialityImpact
integrityImpact
privilegesRequired
userInteractionRequired
}
description
exploitabilityScore
exploitable
externalId
hasCisaKevExploit
id
name
publishedAt
severity
sourceFeeds {
id
name
url
}
sourceUrl
}
pageInfo {
endCursor
hasNextPage
}
totalCount
}
}

Changelog

The Wiz connector has undergone the following changes:

3.1.12

  • Fixed an issue where CVSS_V2_BASE_SCORE and CVSS_V3_BASE_SCORE on the Vulnerability Definition object were not populating.

3.1.11

  • Revised the logic of getting asset type information from the source data.

3.1.10

  • Updated to fetch 'vmId' as the Instance ID for Azure assets.

  • Switched the order of adding attributes to allow native or specific attributes to take higher precedence.

  • Updated dependencies.

3.1.9

  • Fixed an issue where an Empty header line error occurred when reports returned by Wiz were empty.

  • Fixed an issue related to the Missing 1 header column: ["uid"] error.

3.1.8

  • Added a new setting to configure maximum retries.

3.1.7

  • Updated to the new Wiz logo.

  • Enhanced handling for missing UID in objects retrieved from Wiz.

3.1.4

  • Started retrieving the image name for Container Image objects.

  • Started mapping provider ID to the TARGETS attribute in the Issue object.

3.1.1

  • Added more connector objects, such as Database Server, Issue, and Issue Definition.

3.1.0