Wiz Audit Logs connector

Important

This feature is in Beta. To use it, a workspace admin must turn on Lakeflow Connect for Wiz Audit Logs from the Previews page. See Manage Azure Databricks previews.

The managed Wiz Audit Logs connector in Lakeflow Connect allows you to ingest audit log entries, issues, and vulnerability findings from Wiz into Azure Databricks.

Feature availability

Feature	Availability
UI-based pipeline authoring	Supported
API-based pipeline authoring	Supported
Declarative Automation Bundles	Supported
Incremental ingestion	Supported
Unity Catalog governance	Supported
Orchestration using Lakeflow Jobs	Supported
API-based column selection and deselection	Supported
API-based row filtering	Not supported
SCD type 2	Not supported Wiz audit logs, issues, and vulnerability findings are ingested as an append-only feed.
Automated schema evolution: New and deleted columns	Supported
Automated schema evolution: Data type changes	Not supported
Automated schema evolution: Column renames	Supported Treated as a new column (new name) and deleted column (old name).

Authentication methods

Authentication method	Availability
OAuth machine-to-machine (Wiz service account)	Supported
API token	Not supported
Basic authentication (username/password)	Not supported

What to know before you start

Topic	Why it matters
Azure Databricks user persona	The workflow depends on your Azure Databricks user persona: Single-user: An admin user creates a Unity Catalog connection and an ingestion pipeline. Multi-user: An admin user creates a connection for non-admin users to create pipelines with.
Authentication method	The steps to create a connection depend on the authentication method you select.
Interface	The steps to create a pipeline depend on the interface.
Ingestion frequency	The pipeline schedule depends on your latency and cost requirements.
Common patterns	Depending on your ingestion needs, the pipeline might use configurations like history tracking, column selection, and row filtering. Supported configurations vary by connector. See Feature availability.

Start ingesting from Wiz Audit Logs

The following table has an overview of the end-to-end Wiz Audit Logs ingestion flow, based on user type:

User	Steps
Admin	Configure Wiz to enable authentication from Azure Databricks. See Configure authentication to Wiz. Use Catalog Explorer to create a connection to Wiz so that non-admins can create pipelines. See Create a Wiz Audit Logs connection.
Non-admin	Use any supported interface to create a pipeline from an existing connection. See Ingest data from Wiz Audit Logs.