Wiz.io v2.0.0

About the connector

Wiz provides a comprehensive analysis engine that integrates: Cloud Security Posture Management (CSPM) Kubernetes Security Posture Management (KSPM) Cloud Workload Protection (CWPP) + vulnerability management. Infrastructure-as-Code (IaC) scanning.

This document provides information about the Wiz.io connector, which facilitates automated interactions, with a Wiz.io server using FortiSOAR™ playbooks. Add the Wiz.io connector as a step in FortiSOAR™ playbooks and perform automated operations with Wiz.io.

Version information

Connector Version: 2.0.0

FortiSOAR™ Version Tested on: 7.6.0-5012

Authored By: Fortinet

Contributor: Julian Petersohn

Certified: Yes

Release Notes for version 2.0.0

Following enhancements have been made to the Wiz.io connector in version 2.0.0:

• Merged the following actions into Get Issues:
  • Get Issues for Asset
  • Get issues
• Get Vulnerabilities for Asset renamed to Get Vulnerabilities
• Added more parameters to the following actions:
  • Get Issues
  • Get Inventory Assets
  • Get Projects
  • Get Vulnerabilities

Installing the connector

Use the Content Hub to install the connector. For the detailed procedure to install a connector, click here.

You can also use the yum command as a root user to install the connector:

yum install cyops-connector-wiz-io

Prerequisites to configuring the connector

• You must have the credentials of Wiz.io server to which you will connect and perform automated operations.
• The FortiSOAR™ server should have outbound connectivity to port 443 on the Wiz.io server.

Minimum Permissions Required

• Not applicable

Configuring the connector

For the procedure to configure a connector, click here

Configuration parameters

In FortiSOAR™, on the Connectors page, click the Wiz.io connector row (if you are in the Grid view on the Connectors page) and in the Configurations tab enter the required configuration details:

https://api.your-server-location-here.app.wiz.io

Actions supported by the connector

You can use the following automated operations in playbooks and also use the annotations to access operations:

operation: Get Issues

Input parameters

Output

The output contains the following populated JSON schema:

{
    "data": {
        "issues": {
            "nodes": [
                {
                    "id": "",
                    "type": "",
                    "dueAt": "",
                    "notes": [],
                    "status": "",
                    "projects": [
                        {
                            "id": "",
                            "name": "",
                            "slug": "",
                            "riskProfile": {
                                "businessImpact": ""
                            },
                            "businessUnit": ""
                        }
                    ],
                    "severity": "",
                    "createdAt": "",
                    "updatedAt": "",
                    "resolvedAt": "",
                    "sourceRule": {
                        "id": "",
                        "name": "",
                        "controlDescription": "",
                        "securitySubCategories": [
                            {
                                "title": "",
                                "category": {
                                    "name": "",
                                    "framework": {
                                        "name": ""
                                    }
                                }
                            }
                        ],
                        "resolutionRecommendation": ""
                    },
                    "entitySnapshot": {
                        "id": "",
                        "name": "",
                        "tags": {},
                        "type": "",
                        "region": "",
                        "status": "",
                        "createdAt": "",
                        "externalId": "",
                        "nativeType": "",
                        "providerId": "",
                        "cloudPlatform": "",
                        "cloudProviderURL": "",
                        "subscriptionName": "",
                        "subscriptionTags": {},
                        "subscriptionExternalId": "",
                        "resourceGroupExternalId": ""
                    },
                    "serviceTickets": [],
                    "statusChangedAt": ""
                }
            ],
            "pageInfo": {
                "endCursor": "",
                "hasNextPage": ""
            }
        }
    }
}

operation: Get Inventory Assets

Input parameters

Output

The output contains the following populated JSON schema:

{
    "data": {
        "graphSearch": {
            "totalCount": "",
            "pageInfo": {
                "endCursor": "",
                "hasNextPage": ""
            },
            "nodes": [
                {
                    "entities": [
                        {
                            "id": "",
                            "name": "",
                            "properties": {
                                "_productIDs": [],
                                "_vertexID": "",
                                "accessibleFrom.internet": "",
                                "cloudPlatform": "",
                                "cloudProviderURL": "",
                                "creationDate": "",
                                "externalId": "",
                                "hasAdminPrivileges": "",
                                "hasHighPrivileges": "",
                                "hasSensitiveData": "",
                                "isContainerHost": "",
                                "isEphemeral": "",
                                "isManaged": "",
                                "memoryGB": "",
                                "name": "",
                                "nativeType": "",
                                "numAddressesOpenForHTTP": "",
                                "numAddressesOpenForHTTPS": "",
                                "numAddressesOpenForNonStandardPorts": "",
                                "numAddressesOpenForRDP": "",
                                "numAddressesOpenForSSH": "",
                                "numAddressesOpenForWINRM": "",
                                "openToAllInternet": "",
                                "openToEntireInternet": "",
                                "operatingSystem": "",
                                "passwordAuthDisabled": "",
                                "providerUniqueId": "",
                                "region": "",
                                "regionLocation": "",
                                "resourceGroupExternalId": "",
                                "status": "",
                                "subscriptionExternalId": "",
                                "tags": {
                                    "Name": ""
                                },
                                "totalDisks": "",
                                "updatedAt": "",
                                "vCPUs": "",
                                "zone": ""
                            },
                            "type": "",
                            "technologies": [
                                {
                                    "name": "",
                                    "risk": "",
                                    "usage": "",
                                    "status": ""
                                }
                            ]
                        }
                    ]
                }
            ]
        }
    }
}

operation: Get Projects

Input parameters

Output

The output contains the following populated JSON schema:

{
    "data": {
        "projects": {
            "pageInfo": {
                "hasNextPage": "",
                "endCursor": ""
            },
            "totalCount": "",
            "nodes": [
                {
                    "id": "",
                    "name": "",
                    "slug": "",
                    "isFolder": "",
                    "childProjectCount": "",
                    "cloudAccountCount": "",
                    "repositoryCount": "",
                    "kubernetesClusterCount": "",
                    "containerRegistryCount": "",
                    "securityScore": "",
                    "archived": "",
                    "businessUnit": "",
                    "description": "",
                    "workloadCount": "",
                    "licensedWorkloadQuota": "",
                    "riskProfile": {
                        "businessImpact": ""
                    },
                    "nestingLevel": "",
                    "ancestorProjects": ""
                }
            ]
        }
    }
}

operation: Add Comment to Issue

Input parameters

Output

The output contains the following populated JSON schema:

{
    "data": {
        "createIssueNote": {
            "issueNote": {
                "createdAt": "",
                "id": "",
                "text": "",
                "user": ""
            }
        }
    }
}

operation: Get Vulnerabilities

Input parameters

Output

The output contains the following populated JSON schema:

{
    "data": {
      "vulnerabilityFindings": {
        "nodes": [
          {
            "id": "",
            "link": "",
            "name": "",
            "score": "",
            "status": "O",
            "version": "",
            "projects": [
              {
                "id": "",
                "name": "",
                "slug": "",
                "riskProfile": {
                  "businessImpact": ""
                },
                "businessUnit": ""
              }
            ],
            "portalUrl": "",
            "hasExploit": "",
            "resolvedAt": "",
            "description": "",
            "ignoreRules": "",
            "impactScore": "",
            "remediation": "",
            "CVSSSeverity": "",
            "detailedName": "",
            "epssSeverity": "",
            "fixedVersion": "",
            "locationPath": "",
            "layerMetadata": "",
            "CVEDescription": "",
            "dataSourceName": "",
            "epssPercentile": "",
            "lastDetectedAt": "",
            "vendorSeverity": "",
            "detectionMethod": "",
            "epssProbability": "",
            "firstDetectedAt": "",
            "vulnerableAsset": {
              "id": "",
              "name": "",
              "tags": {},
              "type": "",
              "region": "",
              "status": "",
              "ipAddresses": [],
              "cloudPlatform": "",
              "subscriptionId": "",
              "operatingSystem": "",
              "cloudProviderURL": "",
              "providerUniqueId": "",
              "subscriptionName": "",
              "isAccessibleFromVPN": "",
              "subscriptionExternalId": "",
              "hasWideInternetExposure": "",
              "hasLimitedInternetExposure": "",
              "isAccessibleFromOtherVnets": "",
              "isAccessibleFromOtherSubscriptions": ""
            },
            "resolutionReason": "",
            "hasCisaKevExploit": "",
            "validatedInRuntime": "",
            "exploitabilityScore": ""
          }
        ],
        "pageInfo": {
          "endCursor": "",
          "hasNextPage": ""
        }
      }
    }
}

Included playbooks

The Sample - Wiz.io - 2.0.0 playbook collection comes bundled with the Wiz.io connector. These playbooks contain steps using which you can perform all supported actions. You can see bundled playbooks in the Automation > Playbooks section in FortiSOAR™ after importing the Wiz.io connector.

• Add Comment to Issue
• Get Inventory Assets
• Get Issues
• Get Projects
• Get Vulnerabilities

Note: If you are planning to use any of the sample playbooks in your environment, ensure that you clone those playbooks and move them to a different collection since the sample playbook collection gets deleted during connector upgrade and delete.