Interpres Application - Wiz
- Type: Cloud
- Vendor: Wiz
The Wiz app will process Wiz vulnerabilities and issues and turn them into the Vulnerability and Alert DataModel for Interpres.
Vendor setup
Generate a Client ID + Client Secret for Wiz API. This app uses Cognito to generate a API token for operations. When Global Admins create Service Accounts in Wiz, they must assign them specific permissions during the creation process. In order for a Wiz Service Account to use the developer APIs, it must possess (at least) these listed permissions:
- Get Report Download URL and Status - read:reports
- Rerun Report - create:reports
- Get Report Names - read:reports
- Pull Vulnerability Findings - read:vulnerabilities
- Pull Issues - read:issues
- Create Inventory Report - create:reports
App Configuration
App Parameters:
- Username: The API Client ID created
- Password: The API Client Secret created
- Region: The region defines where the tenant resides, e.g., us1, us2, eu1, or eu2
App Validation
Check there is connectivity (green light) in the integration created.
Implemented Actions
-
Get Assets: Get Assets will create an asset report and ingest assets from the report.
-
Get Vulnerability: This action processes the Wiz vulnerability findings which are really are triggered detections. Wiz currently detects ~75,000 distinct vulnerabilities, so an environment with tens of thousands of resources can easily generate hundreds of thousands of Findings related to vulnerabilities.
-
Get Recommended Actions: Get Recommended Actions will execute the Wiz IssuesTable query to obtain a set of Issues and execute CloudConfigurationFindingsPage query to obtain a list of Cloud Configuration Findings. From issues and configuration findings, this app ingests Wiz recommended actions.
-
Get Policies: Get Policies will execute the Wiz IssuesTable query to obtain a set of Issues and execute CloudConfigurationFindingsPage query to obtain a list of Cloud Configuration Findings. From issues and configuration findings, this app ingests Wiz policies.