Wiz

Important

Lakewatch is in Private Preview. To request access, reach out to your Azure Databricks account team.

Lakewatch provides an API connector to ingest audit log entries, issues, and vulnerability findings from Wiz. This article covers prerequisites, configuration instructions, connector schemas, and Lakewatch parser observables.

Prerequisites

The connector requires:

  1. Serverless Lakeflow Spark Declarative Pipelines turned on in your workspace.
  2. Unity Catalog, with privileges to create or use a Unity Catalog connection. See Connection permissions.
  3. A Wiz tenant with administrator access to create a service account.
  4. Permission to grant the service account read access to the audit logs, issues, and vulnerability findings you want to ingest.

Known limitations

  • SCD type 2 is not supported because Wiz security data is ingested as an append-only feed.
  • The connector supports OAuth machine-to-machine (M2M) authentication with a Wiz service account. API token and basic authentication aren't supported.
  • Automated schema evolution supports new and deleted columns, but not data type changes or column renames.
  • Historical lookback can't exceed 180 days. See Choose how far back to ingest.

Configure Wiz for ingestion

In this step, you create a service account in Wiz and note the credentials that you use to create a connection in Databricks.

  1. Sign in to your Wiz tenant as an administrator.
  2. Create a service account for the connector:
    1. In the Wiz portal, go to Settings > Access Management > Service Accounts, then click Add Service Account.
    2. Enter a descriptive Name for the service account.
    3. For Type, select Custom Integration (GraphQL API).
    4. Grant the service account the API scopes for the data you want to ingest:
      • read:resources (required for all ingestion)
      • admin:audit to ingest audit log entries
      • read:issues to ingest issues
      • read:vulnerabilities to ingest vulnerability findings
    5. Leave Projects blank. Selecting one or more projects prevents the service account from querying audit logs, because the admin:audit scope is available only when no project is selected.
    6. Create the service account.
  3. Note the service account's Client ID and Client Secret. Copy the client secret immediately, because Wiz does not display it again after you close the dialog. You enter these values when you create a connection in Databricks.
  4. Get your tenant details. Click your profile icon in the top right of the Wiz portal, then click Tenant Info. Note the following values, which you enter when you create a connection in Databricks:
    • On the General tab, the Authentication URL. This is the token endpoint that the connector uses to exchange the client credentials for an access token. For example, https://auth.app.wiz.io/oauth/token.
    • On the Data Center and Regions tab, your data center. This is your Tenant Data Center.

Tip

When you create a connection through the Lakewatch UI, enter the Tenant Data Center, Client ID, Client Secret, and Authentication URL gathered above.

For more information, see Configure authentication to Wiz.

Next steps

After completing the configuration above, create a datasource with the Wiz connector in the Lakewatch UI. See API connectors for instructions.

Connector and Lakewatch schemas

The connector ingests the following source tables from the default source schema:

Source table Wiz data Built-in Lakewatch parser
audit_log_entries User actions, service account activity, and configuration changes wiz_audit
issues Risks detected in the cloud environment, including status and severity wiz_issues
vulnerability_findings Vulnerabilities, affected assets, severity, and remediation guidance wiz_vulnerability_finding

The connector writes each source table to the datasource's raw destination. Each built-in parser writes a separate parsed table named after the parser, unless you set a parsed destination when you configure the datasource.

Lakewatch-managed columns

The connector adds the following columns to each raw source row:

  • lw_id: A non-null string that Lakewatch uses as the primary key. The connector derives a stable, time-sortable ID from time and the Wiz id field.
  • time: A timestamp used for incremental ingestion. For audit_log_entries, the connector derives time from timestamp. For issues, it derives time from createdAt. For vulnerability_findings, it derives time from updatedAt.

The wiz_issues parser sets the parsed time field from updatedAt, so the parsed table reflects the most recent issue update time.

Each parsed table carries lw_id forward and adds:

  • lw_meta: Standard Lakewatch processing metadata.
  • lw_observables: Values extracted from fields marked as security observables in the parser.

For more information, see Parser reference.

Raw connector table schemas

The following schemas include the Wiz fields and the Lakewatch-managed lw_id and time columns. For field definitions, see the Wiz connector reference.

audit_log_entries

Schema
Column Data type
lw_id STRING
time TIMESTAMP
id STRING
action STRING
requestId STRING
status STRING
timestamp TIMESTAMP
actionParameters STRING
userAgent STRING
sourceIP STRING
serviceAccount STRUCT<id: STRING, name: STRING>
user STRUCT<id: STRING, name: STRING>

issues

Schema
Column Data type
lw_id STRING
time TIMESTAMP
id STRING
sourceRule STRING
createdAt TIMESTAMP
updatedAt TIMESTAMP
dueAt TIMESTAMP
type STRING
resolvedAt TIMESTAMP
statusChangedAt TIMESTAMP
projects ARRAY<STRUCT<id: STRING, name: STRING, slug: STRING, businessUnit: STRING, riskProfile: STRING>>
status STRING
severity STRING
entitySnapshot STRING
serviceTickets STRING
notes STRING

vulnerability_findings

Schema
Column Data type
lw_id STRING
time TIMESTAMP
id STRING
portalUrl STRING
name STRING
CVEDescription STRING
CVSSSeverity STRING
score DOUBLE
exploitabilityScore DOUBLE
impactScore DOUBLE
dataSourceName STRING
hasExploit BOOLEAN
hasCisaKevExploit BOOLEAN
status STRING
vendorSeverity STRING
firstDetectedAt TIMESTAMP
lastDetectedAt TIMESTAMP
updatedAt TIMESTAMP
resolvedAt TIMESTAMP
description STRING
remediation STRING
detailedName STRING
version STRING
fixedVersion STRING
detectionMethod STRING
link STRING
locationPath STRING
resolutionReason STRING
epssSeverity STRING
epssPercentile DOUBLE
epssProbability DOUBLE
validatedInRuntime STRING
layerMetadata STRING
projects ARRAY<STRUCT<id: STRING, name: STRING, slug: STRING, businessUnit: STRING>>
ignoreRules ARRAY<STRUCT<id: STRING, name: STRING, enabled: BOOLEAN>>
vulnerableAsset STRING

Parser observables

The built-in parsers write nested objects as VARIANT and extract the following fields into lw_observables.

wiz_audit

Observables
Field Observable
sourceIP ip
serviceAccount.id actor_id
user.id actor_id
user.name username

The wiz_issues parser doesn't define any observable fields.

wiz_vulnerability_finding

Observables
Field Observable
portalUrl url
link url
  • Last updated on