Skip to content

Commit 05c6dba

Browse files
maxcoldefd6kcreddy
authored
Add new Wiz Cloud Configuration Finding Full Posture data stream and update misconfig transform to use it (#12961)
* add new Wiz Cloud Configuration Finding Full Posture data stream and base latest misconfig findings on it * format and lint * bump major version * fix linting * fix field mapping * Revert "format and lint" This reverts commit d3ad0ea. * update changelog entry and add missing new line * Update resource.tracer settings Co-authored-by: Dan Kortschak <[email protected]> * Update error.message generation logic Co-authored-by: Dan Kortschak <[email protected]> * Remove explicit bytes check Co-authored-by: Dan Kortschak <[email protected]> * add system tests and update docs * update readme and test output * make @timestamp dynamic for pipeline tests * fix system tests * fix system tests config * Update packages/wiz/_dev/build/docs/README.md Co-authored-by: Krishna Chaitanya Reddy Burri <[email protected]> * bump transform version * fix fields in README * fix code formatting Co-authored-by: Dan Kortschak <[email protected]> * pretty print json body in system tests * fix special symbols * Fix spelling Co-authored-by: Dan Kortschak <[email protected]> * fix nits --------- Co-authored-by: Dan Kortschak <[email protected]> Co-authored-by: Krishna Chaitanya Reddy Burri <[email protected]>
1 parent 9cc525e commit 05c6dba

File tree

23 files changed

+1726
-8
lines changed

23 files changed

+1726
-8
lines changed

‎packages/wiz/_dev/build/docs/README.md‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,7 @@ Agentless deployments are only supported in Elastic Serverless and Elastic Cloud
5757
| Issue | read:issues |
5858
| Vulnerability | read:vulnerabilities |
5959
| Cloud Configuration Finding | read:cloud_configuration |
60+
| Cloud Configuration Finding Full Posture | read:cloud_configuration |
6061

6162
### To obtain the Wiz URL
6263
1. Navigate to your user profile and copy the API Endpoint URL.
@@ -105,6 +106,16 @@ This is the `Cloud Configuration Finding` dataset.
105106

106107
{{fields "cloud_configuration_finding"}}
107108

109+
### Cloud Configuration Finding Full Posture
110+
111+
This is the `Cloud Configuration Finding Full Posture` dataset.
112+
113+
#### Example
114+
115+
{{event "cloud_configuration_finding_full_posture"}}
116+
117+
{{fields "cloud_configuration_finding_full_posture"}}
118+
108119
### Issue
109120

110121
This is the `Issue` dataset.

‎packages/wiz/_dev/deploy/docker/docker-compose.yml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,19 @@ services:
2626
- http-server
2727
- --addr=:8090
2828
- --config=/files/config-cloud_configuration_finding.yml
29+
wiz-cloud_configuration_finding_full_posture:
30+
image: docker.elastic.co/observability/stream:v0.15.0
31+
hostname: wiz-cloud_configuration_finding_full_posture
32+
ports:
33+
- 8090
34+
volumes:
35+
- ./files:/files:ro
36+
environment:
37+
PORT: '8090'
38+
command:
39+
- http-server
40+
- --addr=:8090
41+
- --config=/files/config-cloud_configuration_finding_full_posture.yml
2942
wiz-issue:
3043
image: docker.elastic.co/observability/stream:v0.15.0
3144
hostname: wiz-issue

‎packages/wiz/_dev/deploy/docker/files/config-cloud_configuration_finding_full_posture.yml‎

Lines changed: 127 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,127 @@
1+
rules:
2+
- path: /oauth/token
3+
methods: ['POST']
4+
responses:
5+
- status_code: 200
6+
headers:
7+
Content-Type:
8+
- 'application/json'
9+
body: |
10+
{"access_token":"xxxx","expires_in":3600,"token_type":"Bearer","refresh_token":"yyyy"}
11+
- path: /graphql
12+
methods: ['POST']
13+
request_headers:
14+
Authorization:
15+
- 'Bearer xxxx'
16+
request_body: /.*"after":null.*/
17+
responses:
18+
- status_code: 200
19+
headers:
20+
Content-Type:
21+
- application/json
22+
body: |-
23+
{{ minify_json `
24+
{
25+
"data": {
26+
"configurationFindings": {
27+
"nodes": [
28+
{
29+
"analyzedAt": "2024-08-07T12:55:52.012378Z",
30+
"id": "1243196d-a365-589a-a8aa-13817c9877b2",
31+
"remediation": null,
32+
"resource": {
33+
"id": "f0f4163d-cbd7-517c-ba9e-f96bb90ab5ea",
34+
"name": "Root user",
35+
"nativeType": "rootUser",
36+
"providerId": "arn:aws:iam::998231069301:root",
37+
"region": null,
38+
"cloudPlatform": "EKS",
39+
"subscription": {
40+
"cloudProvider": "AWS",
41+
"externalId": "998231069301",
42+
"id": "94e76baa-85fd-5928-b829-1669a2ca9660",
43+
"name": "wiz-integrations"
44+
},
45+
"tags": [],
46+
"type": "USER_ACCOUNT"
47+
},
48+
"result": "PASS",
49+
"rule": {
50+
"description": "description",
51+
"id": "563ed717-4fb6-47fd-929e-9c794e201d0a",
52+
"name": "Root account access keys should not exist",
53+
"remediationInstructions": "instructions",
54+
"shortId": "IAM-006"
55+
},
56+
"severity": "MEDIUM"
57+
}
58+
],
59+
"pageInfo": {
60+
"hasNextPage": true,
61+
"endCursor": "eyJmaWVsZHMiOlt7IkZpZWxkIjoiVGltZXN0YW1wIiwiVmFsdWUiOiIyMDIzLTA5LTA0VDExOjE5OjM3LjgwMTU0MVoifV19"
62+
}
63+
}
64+
}
65+
}
66+
`}}
67+
- path: /graphql
68+
methods: ['POST']
69+
request_headers:
70+
Authorization:
71+
- 'Bearer xxxx'
72+
request_body: /.*"after":"eyJmaWVsZHMiOlt7IkZpZWxkIjoiVGltZXN0YW1wIiwiVmFsdWUiOiIyMDIzLTA5LTA0VDExOjE5OjM3LjgwMTU0MVoifV19".*/
73+
responses:
74+
- status_code: 200
75+
headers:
76+
Content-Type:
77+
- application/json
78+
body: |-
79+
{{ minify_json `
80+
{
81+
"data": {
82+
"configurationFindings": {
83+
"nodes": [
84+
{
85+
"analyzedAt": "2024-08-15T11:41:17.517926Z",
86+
"id": "6fe49e83-2f3a-5b62-99de-beae16c7bfae",
87+
"remediation": null,
88+
"resource": {
89+
"id": "8a53b2d9-f6c6-59e4-bce0-736a45e9aa3f",
90+
"name": "annam-vm",
91+
"nativeType": "Microsoft.Compute/virtualMachines",
92+
"providerId": "80045425-a0a9-4457-82c2-2c5f47419d83",
93+
"region": "eastus",
94+
"subscription": {
95+
"cloudProvider": "Azure",
96+
"externalId": "434f3cbb-30f2-4bc0-8bba-cb080280652b",
97+
"id": "064ecbb5-19ee-540d-b9f5-99c3a4e2d0db",
98+
"name": "partner integrations"
99+
},
100+
"tags": [],
101+
"type": "VIRTUAL_MACHINE"
102+
},
103+
"result": "PASS",
104+
"rule": {
105+
"description": "description",
106+
"id": "56c8890d-ad68-4659-9414-fb0ed7258c31",
107+
"name": "Virtual Machine should not be stopped (allocated) for more than a week",
108+
"remediationInstructions": "remediation",
109+
"shortId": "VirtualMachines-021"
110+
},
111+
"severity": "LOW",
112+
"evidence": {
113+
"cloudConfigurationLink": "https://learn.microsoft.com/en-us/azure/virtual-machines/states-billing",
114+
"configurationPath": null,
115+
"currentValue": "The VM is stopped(allocated) since 2024-08-15",
116+
"expectedValue": "The VM should be used or deallocated"
117+
}
118+
}
119+
],
120+
"pageInfo": {
121+
"hasNextPage": false,
122+
"endCursor": "eMJmaWVsZIkZpZWxkIjoiVGltZXN0YW1wIiwiVmFsdWUiOiIyMDIzLTA5LTA0VDExOjE5OjM3LjgwMTU0MVoifV19"
123+
}
124+
}
125+
}
126+
}
127+
`}}

‎packages/wiz/changelog.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
# newer versions go on top
2+
- version: "3.0.0"
3+
changes:
4+
- description: Add new Cloud Configuration Finding Full Posture data stream. If you rely on Findings > Misconfigurations view, enable this new data stream.
5+
type: breaking-change
6+
link: https://github.com/elastic/integrations/pull/12961
27
- version: "2.10.0"
38
changes:
49
- description: Rely on external ecs for ESC fields. event.id changed from text to keyword

0 commit comments

Comments
 (0)