The Wiz integration is in open beta starting with Panther version 1.110, and is available to all customers. Please share any bug reports and feature requests with your Panther support team.
Panther can fetch Wiz audit, issue, and vulnerability logs by querying the Wiz API.
How to onboard Wiz logs to Panther
Prerequisite
The user setting up this integration must have access to a Wiz tenant and have a Wiz role with permissions to create service accounts (such as a Global Admin).
Step 1: Retrieve your Wiz API endpoint URL
The Wiz GraphQL API has a single endpoint (https://api.<TENANT_DATA_CENTER>.app.wiz.io/graphql), where <TENANT_DATA_CENTER> is the Wiz regional data center in which your tenant resides, e.g., us1, us2, eu1 or eu2. The endpoint is the same regardless of which operation you're performing.
To retrieve your GraphQL endpoint:
In the upper-right corner of your Wiz console, click the user icon > User settings (or this direct link).
On the left side, click Tenant (or this direct link).
Copy your API Endpoint URL and store it in a secure location, as you will need it in a following step.
Step 2: Create a service account in Wiz
In the Wiz dashboard, navigate to Settings > Access Management > Service Accounts.
Click Add Service Account.
In the New Service Account form, fill in the fields:
Name: Provide a descriptive name for the service account, e.g., Panther Integration.
Type: Select Custom Integration (GraphQL API).
Projects (Optional): Select one or more projects this service account will have access to.
Note that selecting one or more projects disallows you from querying Audit logs.
API Scopes:
Select read:resources.
Select the scope(s) listed in the Required API scopes for service account table below for the Wiz log type(s) you plan to ingest into Panther.
Click Add Service Account.
Copy the Client Secret, and store it in a secure location, as you will need it in a following step. You will not be able to view this value after this step.
Copy the Client ID, and store it in a secure location, as you will need it in a following step.
In the left-hand navigation bar of your Panther Console, click Configure > Log Sources.
Click Create New.
Search for "Wiz," then click its tile.
In the upper-right corner of the slide-out panel, click Start Setup.
On the Configure screen, fill in the form:
Name: Enter a descriptive name for the source e.g. My Wiz logs.
Project Ids (Optional): Enter the IDs of the projects you'd like to pull logs for. If this field is left blank, Panther will pull logs for all projects. To find the ID for a given project in the Wiz console:
Click Settings > Projects.
On the right-hand side of the row of the project, click the three dots icon > Project Id. The ID will be copied to your clipboard.
Select the log types you want to monitor: All Wiz log types will be pre-populated.
Click Setup.
On the Set Credentials page, fill in the form:
Token URL: Enter your Wiz API Token URL. This value depends on your Wiz account's identity provider:
Amazon Cognito: Enter https://auth.app.wiz.io/oauth/token.
Auth0: Enter https://auth.wiz.io/oauth/token.
Note that Wiz ended support for Auth0 as an identity provider in December 2022.
API Endpoint: Enter the API Endpoint URL you retrieved from Wiz.
Client ID: Enter the Client ID you generated in Wiz.
Client Secret: Enter the Client Secret you generated in Wiz.
Click Setup. You will be directed to a success screen:
The Trigger an alert when no events are processed setting defaults to YES. We recommend leaving this enabled, as you will be alerted if data stops flowing from the log source after a certain period. The timeframe is configurable, with a default of 24 hours.
The Audit log records key events in Wiz, such as log ins, log outs, and user updates. The Audit log is primarily used to investigate potentially suspicious activity or diagnose and troubleshoot errors.
schema:Wiz.Auditdescription: The Audit Log records key events in Wiz, such as login, logout, and user update. The Audit Log is primarily used to investigate potentially suspicious activity or diagnose and troubleshoot errors.
referenceURL:https://win.wiz.io/reference/audit-logfields: - name:idrequired:truedescription:Unique identifier of the audit log entry.type:string - name:actionrequired:truedescription:The action performed.type:string - name:requestIddescription:Unique identifier of the request.type:string - name:statusdescription:Status of the audit log event.type:string - name:timestamprequired:truedescription:Timestamp of the event.type:timestamptimeFormats: - rfc3339isEventTime:true - name:actionParametersdescription:Parameters related to the action.type:json - name:userAgentdescription:User agent string.type:string - name:sourceIPdescription:Source IP address.type:stringindicators: - ip - name:serviceAccountdescription:Service account associated with the action.type:objectfields: - name:idrequired:truedescription:ID of the service account.type:stringindicators: - actor_id - name:namedescription:Name of the service account.type:string - name:userdescription:User associated with the action, if applicable.type:objectfields: - name:idrequired:truedescription:ID of the user.type:stringindicators: - actor_id - name:namedescription:Name of the user.type:stringindicators: - username
Wiz.Issues
The Issues log records key events in Wiz related to issues, such as vulnerability findings and security incidents. It is used to track, manage, and remediate security vulnerabilities and incidents.
schema:Wiz.Issuesdescription: The Issues Log records key events in Wiz related to issues, such as vulnerability findings and security incidents. It is used to track, manage, and remediate security vulnerabilities and incidents.
referenceURL:https://win.wiz.io/reference/issues-queryfields: - name:idrequired:truedescription:The unique identifier of the issue.type:string - name:sourceRuledescription:The source rule of the issue.type:json - name:createdAtrequired:truedescription:The creation timestamp of the issue.type:timestamp - name:updatedAtdescription:The last update timestamp of the issue.type:timestamp - name:dueAtdescription:The due timestamp of the issue.type:timestamp - name:typedescription:The type of the issue.type:string - name:resolvedAtdescription:The resolution timestamp of the issue.type:timestamp - name:statusChangedAtdescription:The timestamp when the status of the issue changed.type:timestamp - name:projectsdescription:The projects associated with the issue.type:arrayelement:type:objectfields: - name:iddescription:The unique identifier of the project.type:string - name:namedescription:The name of the project.type:string - name:slugdescription:The slug of the project.type:string - name:businessUnitdescription:The business unit of the project.type:string - name:riskProfiledescription:The risk profile of the project.type:json - name:statusdescription:The status of the issue.type:string - name:severitydescription:The severity of the issue.type:string - name:entitySnapshotdescription:The snapshot of the entity related to the issue.type:objectfields: - name:iddescription:The unique identifier of the entity snapshot.type:string - name:typedescription:The type of the entity snapshot.type:string - name:nativeTypedescription:The native type of the entity snapshot.type:string - name:namedescription:The name of the entity snapshot.type:string - name:statusdescription:The status of the entity snapshot.type:string - name:cloudPlatformdescription:The cloud platform of the entity snapshot.type:string - name:cloudProviderURLdescription:The cloud provider URL of the entity snapshot.type:string - name:providerIddescription:The provider ID of the entity snapshot.type:string - name:regiondescription:The region of the entity snapshot.type:string - name:resourceGroupExternalIddescription:The external ID of the resource group.type:string - name:subscriptionExternalIddescription:The external ID of the subscription.type:string - name:subscriptionNamedescription:The name of the subscription.type:string - name:subscriptionTagsdescription:The tags of the subscription.type:json - name:tagsdescription:The tags of the entity snapshot.type:json - name:externalIddescription:The external ID of the entity snapshot.type:string - name:serviceTicketsdescription:The service tickets associated with the issue.type:json - name:notesdescription:Any additional notes related to the issue.type:json
Wiz.VulnerabilityFinding
The Vulnerability Finding log records information about security vulnerabilities detected in Wiz, including details about the vulnerabilities, affected assets, and remediation steps.
schema:Wiz.VulnerabilityFindingdescription: The Vulnerability Finding Log records information about security vulnerabilities detected in Wiz, including details about the vulnerabilities, affected assets, and remediation steps.
referenceURL:https://win.wiz.io/reference/vulnerability-findingfields: - name:idrequired:truedescription:The unique identifier of the vulnerability finding.type:string - name:portalUrldescription:The portal URL of the vulnerability finding.type:stringindicators: - url - name:namedescription:The name of the vulnerability.type:string - name:CVEDescriptiondescription:The CVE description of the vulnerability.type:string - name:CVSSSeveritydescription:The CVSS severity of the vulnerability.type:string - name:scoredescription:The score of the vulnerability.type:float - name:exploitabilityScoredescription:The exploitability score of the vulnerability.type:float - name:impactScoredescription:The impact score of the vulnerability.type:float - name:dataSourceNamedescription:The data source name of the vulnerability finding.type:string - name:hasExploitdescription:Indicates whether the vulnerability has an exploit.type:boolean - name:hasCisaKevExploitdescription:Indicates whether the vulnerability has a CISA/KEV exploit.type:boolean - name:statusdescription:The status of the vulnerability finding.type:string - name:vendorSeveritydescription:The vendor severity of the vulnerability.type:string - name:firstDetectedAtdescription:The timestamp when the vulnerability was first detected.type:timestamptimeFormats: - rfc3339 - name:lastDetectedAtdescription:The timestamp when the vulnerability was last detected.type:timestamptimeFormats: - rfc3339 - name:resolvedAtdescription:The timestamp when the vulnerability was resolved.type:timestamp - name:descriptiondescription:The description of the vulnerability.type:string - name:remediationdescription:The remediation steps for the vulnerability.type:string - name:detailedNamedescription:The detailed name of the vulnerability.type:string - name:versiondescription:The version affected by the vulnerability.type:string - name:fixedVersiondescription:The fixed version of the vulnerability.type:string - name:detectionMethoddescription:The method used for detecting the vulnerability.type:string - name:linkdescription:The link related to the vulnerability.type:stringindicators: - url - name:locationPathdescription:The location path of the vulnerability.type:string - name:resolutionReasondescription:The reason for resolving the vulnerability.type:string - name:epssSeveritydescription:The EPSS severity of the vulnerability.type:string - name:epssPercentiledescription:The EPSS percentile of the vulnerability.type:float - name:epssProbabilitydescription:The EPSS probability of the vulnerability.type:float - name:validatedInRuntimedescription:Indicates whether the vulnerability was validated in runtime.type:string - name:layerMetadatadescription:The layer metadata of the vulnerability.type:json - name:projectsdescription:The projects associated with the vulnerability finding.type:arrayelement:type:objectfields: - name:iddescription:The unique identifier of the project.type:string - name:namedescription:The name of the project.type:string - name:slugdescription:The slug of the project.type:string - name:businessUnitdescription:The business unit of the project.type:string - name:riskProfiledescription:The risk profile of the project.type:json - name:ignoreRulesdescription:The ignore rules for the vulnerability.type:json - name:vulnerableAssetdescription:The vulnerable asset associated with the vulnerability finding.type:objectfields: - name:iddescription:The unique identifier of the vulnerable asset.type:string - name:typedescription:The type of the vulnerable asset.type:string - name:namedescription:The name of the vulnerable asset.type:string - name:regiondescription:The region of the vulnerable asset.type:string - name:providerUniqueIddescription:The unique identifier of the provider.type:string - name:cloudProviderURLdescription:The cloud provider URL of the vulnerable asset.type:stringindicators: - url - name:cloudPlatformdescription:The cloud platform of the vulnerable asset.type:string - name:statusdescription:The status of the vulnerable asset.type:string - name:subscriptionNamedescription:The name of the subscription.type:string - name:subscriptionExternalIddescription:The external ID of the subscription.type:string - name:subscriptionIddescription:The ID of the subscription.type:string - name:tagsdescription:The tags of the vulnerable asset.type:json - name:hasLimitedInternetExposuredescription:Indicates whether the vulnerable asset has limited internet exposure.type:boolean - name:hasWideInternetExposuredescription:Indicates whether the vulnerable asset has wide internet exposure.type:boolean - name:isAccessibleFromVPNdescription:Indicates whether the vulnerable asset is accessible from VPN.type:boolean - name:isAccessibleFromOtherVnetsdescription:Indicates whether the vulnerable asset is accessible from other VNets.type:boolean - name:isAccessibleFromOtherSubscriptionsdescription:Indicates whether the vulnerable asset is accessible from other subscriptions.type:boolean - name:operatingSystemdescription:The operating system of the vulnerable asset.type:string - name:ipAddressesdescription:The IP addresses of the vulnerable asset.type:arrayelement:type:stringindicators: - ip