HomeGuidesAPI ReferenceChangelogDiscussions
Log In

Wiz

Suggest Edits

Wiz.io CLI

This CLI is provided to perform batch processing and orchestration of the Wiz.io Cloud-Native Application Protection Platform (CNAPP). It is designed to perform bulk processing of Wiz data to create, update, and otherwise sync with RegScale to allow for compliance automation reporting. The CLI currently supports the follow functionalities:

  • authenticate - Authenticate with Wiz and get a JSON Web Token (JWT) for future requests to Wiz
  • inventory - syncs all Wiz entities into RegScale as assets
  • issues - syncs any identified problems as issues/POAMs to RegScale
  • sync_compliance - syncs compliance posture from Wiz to RegScale

Permissions required from Wiz.io

This CLI functionality uses the Wiz API to pull issues and entities from Wiz. We require that the user sets up a service account with the following permissions:
create:reports read:all read:resources read:connectors read:outposts

read:sensors read:security_scans read:scanner_settings read:issue_settings read:users
read:service_accounts read:projects read:issues read:controls read:automation_actions
read:integrations read:action_templates read:reports read:inventory read:vulnerabilities
read:host_configuration read:cloud_accounts read:scan_policies read:security_settings
read:security_frameworks read:system_activities read:cloud_events read:cloud_event_rules
read:licenses read:kubernetes_clusters read:digital_trust_settings read:admission_controllers
read:custom_file_detection read:network_exposure create:reports update:reports write:reports

Update bash environment for CLI

# These environment variables need to be optionally available to the CLI, OR they can be passed as a command line argument.
export WizClientID='WIZ CLIENT ID'
export WizClientSecret='WIZ CLIENT SECRET'

init.yaml Configuration

There are multiple pieces of information needed to configure the Wiz.io integration via the CLI:

  • maxThreads - The total number of threads the application is allowed to use for bulk processing. The default value is 1000. (NOTE: Changing this number can have a negative or positive impact on performance.)
  • wizUrl - GraphQL endpoint for your Wiz.io instance
  • wizAuthUrl - URL for granting authentication tokens (default set in the example file, but government customers may require an alternate URL)
  • wizExcludes - flags the specific assets to exclude from syncing to RegScale. For each node, this is based on the entities[0]["name"] attribute.
  • issues: {wiz: {critical: 30, high: 90, medium: 90, low: 365, status: Open}} - number of days to add to today's date when setting due dates to RegScale issues based on Wiz severity and the status to use for a new RegScale issue.

Wiz Setup Workfow

  1. Get the Wiz URL.
    • Click the user profile icon in the top right, and navigate to "User Settings".
    • Copy and paste the API Endpoint URL from this page into the wizUrl field.
  2. Create a service account within Wiz.
    • Click the gears icon for setup in the top right and navigate to "Service Accounts" -> "Add Service Account". Give it the appropriate name and permissions (minimum of "read:all").
    • Add the service account and copy and paste the client ID and client secret into the init.yaml file.
    • The wizAuthUrl is set by default for commercial customers but you may need to change it if using a specific service such as GovCloud.
    • The wizExcludes flag lets you determine which assets you do not want to sync and will exclude them from processing.
    • Once done, you should have all configuration necessary to perform Wiz integrations using the RegScale CLI.

Issue Processing Workflow

The CLI currently supports processing Wiz issues. The issue processing workflow is shown below:

  • The user first logs into RegScale via the CLI to set the access token or otherwise creates a service account as described in the CLI Login documentation.
  • The user then logs into Wiz using the Client ID and Client Secret to generate an access token with the appropriate scope (NOTE: The access token and scope are automatically generated from the Wiz authenticate CLI).
  • The user then calls the CLI to process Wiz issues while setting the following flags:
    • regscale_id - the ID # of the RegScale record associated with these issues
    • regscale_module - the RegScale module of the record associated wit these issues, please view RegScale Modules for options.
  • The CLI retrieves all existing issues in RegScale for the key value pair provided above.
  • The CLI then creates an automated report in Wiz, waits for it to update and retrieves all open issues in Wiz.io.
  • The CLI then processes through all retrieved Wiz issues and does the following:
    • Sees if a RegScale issue already exists, if so, it updates it.
    • If no RegScale issue exists, it creates a new one.
  • The CLI then processes through all existing RegScale issues and sees if the Wiz.io issue still exists. If not, it has been remediated and the CLI closes the RegScale issue.

The CLI provides detailed logging throughout the process to indicate progress and to provide troubleshooting in case of issues.

Issue CLI Command Example

The following command provide an example of processing Wiz issues for a given RegScale System Security Plan (SSP). These commands can be easily adapted for the customer's specific use case. The steps are shown below:

  • Log into RegScale to set the token, which is good for 24 hours, and will secure all future RegScale API calls. (NOTE: You can skip this step if you are using a RegScale Service Account)
regscale login
  • Authenticate to Wiz to get an access token for GraphQL calls.
regscale wiz authenticate
  • Process the appropriate level of issues for the given security plan.
regscale wiz issues --regscale_id=5  --regscale_module="securityplans"

Inventory Processing Workflow

The CLI currently supports processing Wiz entities as assets into RegScale. The inventory processing workflow is shown below:

  • The user first logs into RegScale via the CLI to set the access token or otherwise creates a service account as described in the CLI Login documentation.
  • The user then logs into Wiz passing the Client ID and Client Secret to the command line to generate an access token with the appropriate scope (NOTE: The access token and scope are automatically generated from the Wiz authenticate CLI).
  • The user then calls the CLI to process Wiz inventory while setting the following flags:
    • regscale_id - the ID # of the RegScale record associated with these issues
    • regscale_module - the RegScale module of the record associated wit these issues (OPTIONS - securityplans, supplychain, projects, policies, components)
  • The CLI then retrieves all existing assets in RegScale for the key value pair provided above.
  • The CLI then creates an automated report in Wiz, waits for it to update and retrieves all entities in Wiz.io using a user provided filter (see init.yaml below) or using a default filter.
  • The CLI then processes through all retrieved Wiz entities and does the following:
    • Sees if a RegScale asset already exists, if so, it updates it.
    • If no RegScale asset exists, it creates a new one.

The CLI provides detailed logging throughout the process to indicate progress and to provide troubleshooting in case of any problems.

Inventory CLI Command Example

The following command provide an example of processing Wiz entities for a given RegScale Security Plan. These commands can be easily adapted for the customer's specific use case. The steps are shown below:

  • Log into RegScale to set the token, which is good for 24 hours, and will secure all future RegScale API calls. (NOTE: You can skip this step if you are using a RegScale Service Account)
regscale login
  • Authenticate to Wiz to get an access token for GraphQL calls.
regscale wiz authenticate
  • Process assets for the given security plan.
regscale wiz inventory --regscale_id=5 --regscale_module="securityplans"

There are several advanced features available for the inventory wiz integration new in 5.31.0

--filter_by_override: see below for possible values

--full_inventory: sync all cloud resources from wiz into your security plan if not passed will default to false and use the new last inventory pull date in the yaml file and will sync anything added from wiz from that date forward.

regscale wiz inventory \
  --wiz_project_id="123,456" \
  --regscale_id=5 \
  --regscale_module="securityplans" \
  --filter_by_override='{projectId: ["1234"], type: ["VIRTUAL_MACHINE"], subscriptionExternalId: ["1234"], providerUniqueId: ["1234"], updatedAt: {after: "2023-06-14T14:07:06Z"}, search: "test-7"}' \
  --full_inventory

Filter Parameters for Inventory filter by override json string may contain any of the follow but must include the projectID

projectID [String!]

  • Description: Filter cloud resources by Wiz project ID. You can specify multiple values in an array.
  • Note: If no values are provided, then returns results from all projects.

type [Wiz GraphEntityTypeValue!]

  • Description: Filter cloud resources by specific entity types. You can specify multiple values in an array.
  • Possible values:
    • ACCESS_ROLE
    • ACCESS_ROLE_BINDING
    • ACCESS_ROLE_PERMISSION
    • API_GATEWAY
    • BACKUP_SERVICE
    • BUCKET
    • CDN
    • CICD_SERVICE
    • CLOUD_LOG_CONFIGURATION
    • CLOUD_ORGANIZATION
    • COMPUTE_INSTANCE_GROUP
    • CONFIG_MAP
    • CONTAINER
    • CONTAINER_GROUP
    • CONTAINER_IMAGE
    • CONTAINER_REGISTRY
    • CONTAINER_REPOSITORY
    • CONTAINER_SERVICE
    • CONTROLLER_REVISION
    • DAEMON_SET
    • DATABASE
    • DATA_WORKFLOW
    • DATA_WORKLOAD
    • DB_SERVER
    • DEPLOYMENT
    • DNS_RECORD
    • DNS_ZONE
    • DOMAIN
    • EMAIL_SERVICE
    • ENCRYPTION_KEY
    • FILE_SYSTEM_SERVICE
    • FIREWALL
    • GATEWAY
    • GOVERNANCE_POLICY
    • GOVERNANCE_POLICY_GROUP
    • KUBERNETES_CLUSTER
    • KUBERNETES_CRON_JOB
    • KUBERNETES_INGRESS
    • KUBERNETES_INGRESS_CONTROLLER
    • KUBERNETES_JOB
    • KUBERNETES_NETWORK_POLICY
    • KUBERNETES_NODE
    • KUBERNETES_PERSISTENT_VOLUME
    • KUBERNETES_PERSISTENT_VOLUME_CLAIM
    • KUBERNETES_POD_SECURITY_POLICY
    • KUBERNETES_SERVICE
    • KUBERNETES_STORAGE_CLASS
    • KUBERNETES_VOLUME
    • LOAD_BALANCER
    • MANAGEMENT_SERVICE
    • MANAGED_CERTIFICATE
    • MAP_REDUCE_CLUSTER
    • MESSAGING_SERVICE
    • MONITOR_ALERT
    • NAMESPACE
    • NETWORK_ADDRESS
    • NETWORK_INTERFACE
    • PEERING
    • POD
    • PRIVATE_ENDPOINT
    • PRIVATE_LINK
    • RAW_ACCESS_POLICY
    • REGISTERED_DOMAIN
    • REGION
    • REPLICA_SET
    • RESOURCE_GROUP
    • ROUTE_TABLE
    • SEARCH_INDEX
    • SECRET
    • SECRET_CONTAINER
    • SERVERLESS
    • SERVERLESS_PACKAGE
    • SERVICE_CONFIGURATION
    • SERVICE_USAGE_TECHNOLOGY
    • SNAPSHOT
    • STATEFUL_SET
    • STORAGE_ACCOUNT
    • SUBNET
    • SUBSCRIPTION
    • VIRTUAL_DESKTOP
    • VIRTUAL_MACHINE
    • VIRTUAL_MACHINE_IMAGE
    • VIRTUAL_NETWORK
    • VOLUME
    • WEB_SERVICE

search String

  • Description: Filter by free text search on cloud resource name.
  • Note: Returns NULL if no match is found.

subscriptionExternalId [String!]

  • Description: Filter cloud resources according to these external subscription IDs (AWS Account, Azure Subscription, GCP Project, and OCI Compartment). You can specify multiple values in an array.
  • Note: If no values are provided, then returns results from all external IDs.

providerUniqueId [String!]

  • Description: Filter cloud resources according to these cloud service provider unique IDs. You can specify multiple values in an array.
  • Note: If no values are provided, then returns results from all provider unique IDs.

updatedAt CloudResourcesDateFilters

  • Description: This object contains cloud resource date filters to narrow down your report results. Use to return cloud resources that were created or updated in the specified date period.
    • before DateTime (Format: yyyy-MM-dd'T'HH:mm:ss'Z' - ISO 8601)
    • after DateTime (Format: yyyy-MM-dd'T'HH:mm:ss'Z' - ISO 8601)

deletedAt CloudResourcesDateFilters

  • Description: This object contains cloud resource date filters to narrow down your report results. Use to return cloud resources that were deleted in the specified date period.
    • before DateTime (Format: yyyy-MM-dd'T'HH:mm:ss'Z' - ISO 8601)
    • after DateTime (Format: yyyy-MM-dd'T'HH:mm:ss'Z' - ISO 8601)

init.yaml Example

For a basic Wiz integration with RegScale, the following init.yaml structure is necessary (example/notional key structure shown below, replace with actual customer keys):

domain: https://mycompany.regscale.com
token: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVC38.eyJzdWIiOiJob3dpZWF2cCIsImp0aSI6ImI0NDIxMjRhLTYxOWEtNGI1Mi1hMzUzLTA5YzdjZTRmM2JmOCIsImlhdCI6MTY0NDc4NzY4MiwiaHR0cDovL3NjaGVtYXMueG1sc29hcC5vcmcvd3MvMjAwNS8wNS9pZGVudGl0eS9jbGFpbXMvbmFtZWlkZW50aWZpZXIiOiJjOWY1NzllMi1hOGM4LTRjMDItOGU5MS1jZTEyMmExYWE1MTciLCJodHRwOi8vc2NoZW1hcy54bWxzb2FwLm9yZy93cy8yMDA1LzA1L2lkZW50aXR5L2NsYWltcy9uYW1lIjoiaG93aWVhdnAiLCJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dzLzIwMDgvMDYvaWRlbnRpdHkvY2xhaW1zL3JvbGUiOiJBZG1pbmlzdHJhdG9yIiwibmJmIjoxNjQ0Nzg3NjgyLCJleHAiOjE2NDQ4NzQwODIsImlzcyI6IkF0bGFzIiwiYXVkIjoiaHR0cDovL2xvY2FsaG9zdDo1MDAwLyJ9.SkjmRktGLkljysVeoRqcx_hHiVR2gjcA2uZiSJbVkPc
maxThreads: 1000
userId: c9f579e2-a8c9-4c02-8e91-ce122a1aa518
wizAccessToken: ztJhbGciOiTHUzI1NiIsInR5cCI5IkpXVCIsImtpZCI6IndJUnZwVWpBTU93WHQ5ZG5CXzRrVCU8.eyJodHRwczovL3dpei5pbyI6eyJ0ZW5hbnRJZCI6IjljZWQ3NmZjLTM3YjMtNDMxNy05OWQ3LTUwYjE1MDA4MDc3MiIsImVtYWlsIjoidGhvd2VydG9uQGMybGFicy5jb20iLCJkYXRhQ2VudGVyIjoidXM4IiwiaXNTZXJ2aWNlQWNjb3VudCI6dHJ1ZSwicHJvZHVjdElkcyI6WyIqIl19LCJpc3MiOiJodHRwczovL2F1dGgud2l6LmlvLyIsInN1YiI6InRGdzhWZVNnVnlsaTlXd0N4UkZCTDZzemZ6eW9DV3lzQGNsaWVudHMiLCJhdWQiOiJiZXlvbmQtYXBpIiwiaWF0IjoxNjQ0Nzg3NzM2LCJleHAiOjE2NDQ4NzQxMzYsImF6cCI6InRGdzhWZVNnVnlsaTlXd0N4UkZCTDZzemZ6eW9DV3lzIiwic2NvcGUiOiJjcmVhdGU6Y29udHJvbHMgY3JlYXRlOnNlY3VyaXR5X2ZyYW1ld29ya3MgZGVsZXRlOmNvbnRyb2xzIGRlbGV0ZTpzZWN1cml0eV9mcmFtZXdvcmtzIHJlYWQ6aXNzdWVzIHJlYWQ6Y29udHJvbHMgcmVhZDppbnZlbnRvcnkgcmVhZDp2dWxuZXJhYmlsaXRpZXMgcmVhZDpzZWN1cml0eV9mcmFtZXdvcmtzIHVwZGF0ZTppc3N1ZXMgdXBkYXRlOmNvbnRyb2xzIHVwZGF0ZTppbnZlbnRvcnkgdXBkYXRlOnNlY3VyaXR5X2ZyYW1ld29ya3MiLCJndHkiOiJjbGllbnQtY3JlZGVudGlhbHMiLCJwZXJtaXNzaW9ucyI6WyJjcmVhdGU6Y29udHJvbHMiLCJjcmVhdGU6c2VjdXJpdHlfZnJhbWV3b3JrcyIsImRlbGV0ZTpjb250cm9scyIsImRlbGV0ZTpzZWN1cml0eV9mcmFtZXdvcmtzIiwicmVhZDppc3N1ZXMiLCJyZWFkOmNvbnRyb2xzIiwicmVhZDppbnZlbnRvcnkiLCJyZWFkOnZ1bG5lcmFiaWxpdGllcyIsInJlYWQ6c2VjdXJpdHlfZnJhbWV3b3JrcyIsInVwZGF0ZTppc3N1ZXMiLCJ1cGRhdGU6Y29udHJvbHMiLCJ1cGRhdGU6aW52ZW50b3J5IiwidXBkYXRlOnNlY3VyaXR5X2ZyYW1ld29ya3MiXX0.ql8YFHdwbTkKkNjHxOSWvcsi9t7n1NeFQ4IXGP3-WGGwsPob14jK9_hLQpqYq9TF4lj_J82wGp57GHBN0VEc5E3sHW035ED4H8g9yxMRnCHgFuC9m8rTyIP6FKdxk8ttJ7nmNE5BVQAYAgpV0SeAUTiu0AD64s_2ocesfQ6P3pb_7xSsHsuU3ZzKLhZtvwcAjYbWXu2YAu9JXVci354m6e38ZVK7d8m5Tc0_lVCRHRsmVYgwBJKbvnGfP9czhZ7GVt9vxRxuJJu7jph-gXgbHj4ma6dQCIHLQ5-jEFSkHiQfVsVXD1McR1A2y80-ix7I8Ygj0nq-lQlEx3ADf-iBzQ
wizClientId: jth895StaYLli9WwCxRFBL6szfzyobeth
wizClientSecret: SarahLy58hzLvy37830TfpozrKpexLhaPcoGU2hY4fJiIBwVAelbTHkupjTdknox
wizScope: create:controls create:security_frameworks delete:controls delete:security_frameworks
  read:issues read:controls read:inventory read:vulnerabilities read:security_frameworks
  update:issues update:controls update:inventory update:security_frameworks
wizUrl: https://api.us7.app.wiz.io/graphql
wizAuthUrl: https://auth.wiz.io/oauth/token
wizEntities:
-  API_GATEWAY
-  APPLICATION
-  BACKUP_SERVICE
-  BUCKET
-  CDN
-  CONTAINER
-  DATABASE
-  DB_SERVER
-  DOMAIN
-  POD
-  REGISTERED_DOMAIN
-  SWITCH
-  VIRTUAL_DESKTOP
-  VIRTUAL_MACHINE
-  VIRTUAL_MACHINE_IMAGE
-  VOLUME
-  WEB_SERVICE
wizInventoryReportId:
- 937a4c31-3036-4069-a35b-2efblah0880
- 19sklb70-5653-4a1f-bd2e-ed5612f8ec75
- a6booab07-888a-4e30-a286-fe8cb8e458f5
- 1a92d35e-e9ad-421d-b55d-275wsa1150
wizIssuesReportId:
  last_seen: '2023-01-23 08:22:12'
  report_id: 63asaq6f-d361-415f-b68b-6dfewb9883f
wizExcludes: Azure AD Builtin Application Service Principal, Azure Active Directory (AAD) User
issues:
  wiz:
    critical: 30
    high: 90
    low: 365
    medium: 90
    status: Open

NOTE: The wizScope and wizAccessToken will auto-populate after authenticated to Wiz via the CLI.

Building a Bash Script to Execute the CLI

You can chain together RegScale CLI commands using scripts. These scripts could be in Bash, Python, PowerShell, etc. Below is an example Bash file (named "regscaleScheduler.sh") in Ubuntu for executing the Wiz CLI that pulls all issues and inventory after authenticating and assigns them to a specific Security Plan in RegScale:

#!/bin/sh
# Wiz will now authenticate for a fresh token on every execution of the issues or inventory functions.
regscale wiz issues --regscale_id=5  --regscale_module="securityplans"
regscale wiz inventory --regscale_id=5 --regscale_module="securityplans"

To execute the Bash file, run this command: . regscaleScheduler.sh. You can chain together any arbitrary set of CLI commands to have them execute sequentially.

sync_compliance - Sync compliance posture from Wiz to RegScale

regscale wiz sync_compliance --help

Usage: regscale wiz sync_compliance [OPTIONS]

Sync compliance posture from Wiz to RegScale

Options:
-p, --wiz_project_id TEXT Enter the Wiz Project ID. Options include:
projects, policies, supplychain,
securityplans, components. [required]
--regscale_id INTEGER RegScale will create and update issues as
children of this record. [required]
--regscale_module TEXT Enter the RegScale module name.

                              RegScale Module           Accepted Value
                             Assessment                | assessments
                             Asset                     | assets
                             Case                      | cases
                             Catalogue                 | catalogues
                             Causal Analysis           | causalanalysis
                             Component                 | components
                             Data Call                 | datacalls
                             Exception                 | exceptions
                             Incident                  | incidents
                             Interconnect              | interconnects
                             Issue(POAM)               | issues
                             Policy                    | policies
                             Project                   | projects
                             Questionnaire             | questionnaires
                             Requirement               | requirements
                             Risk                      | risks
                             Security Control          |
                              securitycontrols         Security Control
                              Implementation | controls
                             Security Plan             | securityplans
                             Security Profile          | profiles
                             Supply Chain(Contract)    | supplychain
                             Task                      | tasks
                             Threat                    | threats
                              [required]

-i, --client_id TEXT Wiz Client ID. Can also be set as an
environment variable: WIZ_CLIENT_ID
-s, --client_secret TEXT Wiz Client Secret. Can also be set as an
environment variable: WIZ_CLIENT_SECRET
-c, --catalog_id TEXT RegScale Catalog ID for the selected
framework. [required]
-f, --framework [CSF|NIST800-53R5|NIST800-53R4]
Choose either one of the Frameworks
[required]
-n, --include_not_implemented Include not implemented controls
--help Show this message and exit.

Updated 13 days ago