Wiz

Wiz analyzes all layers of the cloud stack to identify high-risk attack vectors to be prioritized and fixed.

Types of Assets Fetched

This adapter fetches the following types of assets:

• Devices
• Users

Parameters

1. Wiz URL (required) - The URL of the API of the Wiz server that Axonius can communicate with via the Required Ports. Retrieving the Wiz URL from the user profile https://app.wiz.io/user/profile. 'https://' is required.
2. Wiz Authentication URL (required) - Enter the authentication URL of either the Amazon Cognito or Auth0 (legacy) method of authentication used to enable the connection to Wiz together with the API token.

3. Client Key and Client Secret (required) - See Obtaining the Client Secret and Client ID for details about how to obtain the Client Key and Client Secret.
4. Use legacy connection (required, default: true) - Select whether to use the legacy connection or the new Report API connection. There are separate permissions for the legacy connection and the new Report connection. Make sure you choose the appropriate permissions.

6. HTTPS Proxy (optional) - Connect the adapter to a proxy instead of directly connecting it to the domain.
7. Project ID Mapping (Legacy Only) - Enter the Project ID of the account to fetch.
8. Project UUID - Enter a project UUID to fetch resources only from the project listed.

To learn more about common adapter connection parameters and buttons, see Adding a New Adapter Connection.

Advanced Settings

1. Asset types to fetch (optional, default: VIRTUAL_MACHINE) - Select one or more types of assets to fetch.
2. Do not fetch devices where Power State is Turned Off (optional) - When selected, devices with a power state 'off' are not fetched by Axonius.
3. Fetch issues (required) - Select whether to fetch issues and enrich devices with issue data.
4. Fetch issues evidence (non-legacy) (required) - Select whether to fetch issues evidence data. This option is only available for non-legacy connections.
5. Issues severity to fetch (required, default: CRITICAL, HIGH, MEDIUM) - Select one or more severity levels to filter issues that are fetched.
6. Issues status to fetch (required, default: OPEN, IN_PROGRESS) - Select one or more statuses to filter issues that are fetched.
7. Fetch vulnerability findings (optional) - Select to fetch vulnerability information from Wiz.
8. Vulnerability findings severity to fetch (required, default: CRITICAL, HIGH, MEDIUM) - Select one or more severity levels of vulnerability findings to filter findings that are fetched. Select 'NONE' to not filter per vulnerability findings severity.
9. Attach volumes to associated VMs (required, default: True) - Select this option to attach cloud storage volumes to their associated VMs. When you select this option, volumes are not created as separate devices. When the option is cleared, each volume is created as a separate device.
10. List of tags to parse as fields - Specify a comma-separated list of tag keys to be parsed as device fields. Each tag is a key-value pair that is part of the Adapter Tags complex field.
11. Fetch Wiz users (Required, default: False): Select this option to fetch Wiz users (Wiz platform user accounts).

APIs

Axonius uses the wiz.io API.

Obtaining the Client Secret and Client ID

To obtain the Wiz URL

• Navigate to your user profile and copy the API Endpoint URL.
  
  

To obtain the Wiz Client ID and Client Secret

1. Navigate to Settings > Service Accounts .
2. Click Add Service Account.
3. Name the new service account, for example: Axonius Integration
4. If you desire, narrow the scope of this service account to specific projects.
5. Select the permission read:resources and click Add Service Account.
6. Copy the CLIENT SECRET. Note that you won't be able to copy it after this stage.
7. Copy the CLIENT ID, which is displayed under the Service Accounts page.

Required Ports

Axonius must be able to communicate with the value supplied in Wiz URL via the following ports:

• TCP port 443
  
  

Required Permissions

The value supplied in Client ID must have the following permissions:

• Fetch Wiz users advanced configuration requires read:users. This only applies to New Report connection.

Supported From Version

Supported from Axonius version 4.4