Vulnerability Findings
Collects and processes Wiz Vulnerabilities logs from the Wiz API, ensuring continuous monitoring and reporting of vulnerabilities.
Sync Type: Incremental
Requirements
- Before connecting Monad to Wiz, you need to obtain API credentials (Client ID and Client Secret). These credentials allow access to the Wiz API to fetch cloud configuration findings.
- Ensure that your Wiz credentials have the appropriate permissions to access the necessary API endpoints. To access Vulnerabilities specifically, make sure your credentials have
create:reports,read:vulnerabilitiesandupdate:reportspermissions.
Details
Monad connects to the Wiz API to collect Vulnerabilities data. The connector operates on incremental syncs. For subsequent runs, the connector fetches all data since the report was first generated, and retrieves only vulnerabilities that were updated after this timestamp using the updatedAt filter on the Wiz API.
Configuration
The following configuration defines the input parameters. Each field's specifications, such as type, requirements, and descriptions, are detailed below.
Settings
| Setting | Type | Required | Description |
|---|---|---|---|
| Endpoint URL | string | Yes | Endpoint URL to connect to Wiz. |
| Asset Type | string | Yes | Your Wiz Asset Types for Vulnerability Findings. |
| Vendor Severity | Array | No | Your Wiz Vendor Severity for Vulnerability Findings. |
| Asset Status | Array | No | Vulnerability Findings for assets with these statuses |
| Status | Array | No | The status of a Vulnerability Finding. |
| Detection Method | Array | No | Vulnerability Findings found via these detection methods. |
| Backfill Start Time | string | No | The date to start fetching data from. If not specified, no past records will be fetched. |
| API Rate Limit | object | No | Optional limit on the connector's outbound request rate to the source API. Leave blank to use the connector's default behavior. See API Rate Limiting for the field format, limits, and how to choose a value. |
Secrets
| Secret | Type | Required | Description |
|---|---|---|---|
| Client ID | string | Yes | Client ID for the Wiz API. This is required to authenticate requests. |
| Client Secret | string | Yes | Client Secret for the Wiz API. This is required to authenticate requests. |
OCSF Conversion
The following JQ transformations convert Wiz Vulnerability data to OCSF Version 1.1.0 compliant format based on the selected asset type.
Container Image Asset Type
Serverless Asset Type
Customization Notes
Both transformations serve as starting points and can be modified to accommodate specific requirements while maintaining OCSF compliance. The mappings prioritize essential vulnerability and asset information while providing appropriate handling of status transitions and severity levels.
Sample Record
Code
Sync frequency
This input polls on a connector-specific interval. A cron schedule configured on the pipeline overrides this cadence. See Input Sync Frequency for details.