Skip to content

[Wiz] Add links to the wiz events#13445

Merged
kcreddy merged 2 commits intoelastic:mainfrom
moxarth-rathod:add-link-to-wiz-events
Apr 13, 2025
Merged

[Wiz] Add links to the wiz events#13445
kcreddy merged 2 commits intoelastic:mainfrom
moxarth-rathod:add-link-to-wiz-events

Conversation

@moxarth-rathod
Copy link
Copy Markdown
Contributor

@moxarth-rathod moxarth-rathod commented Apr 7, 2025 •
edited
Loading

Proposed commit message

We got the event.id field from the wiz data and with the use of that field, we're generating a URL/link to the wiz events to investigate them.

Note:

  • for the vulnerability data stream, there is a link present in wiz.vulnerability.portal_url so I did not add an extra processor for that.

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.
  • I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test this PR locally

  • Clone integrations repo.
  • Install elastic package locally.
  • Start elastic stack using elastic-package.
  • Move to integrations/packages/m365_defender directory.
  • Run the following command to run tests.

elastic-package test

Related issues

@moxarth-rathod moxarth-rathod added enhancement New feature or request Integration:wiz Wiz Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations] Team:SDE-Crest Crest developers on the Security Integrations team [elastic/sit-crest-contractors] labels Apr 7, 2025
@moxarth-rathod moxarth-rathod self-assigned this Apr 7, 2025
@moxarth-rathod moxarth-rathod requested a review from a team as a code owner April 7, 2025 12:44
@elasticmachine
Copy link
Copy Markdown

elasticmachine commented Apr 7, 2025

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

@moxarth-rathod moxarth-rathod marked this pull request as draft April 7, 2025 13:04
@elastic-vault-github-plugin-prod
Copy link
Copy Markdown

elastic-vault-github-plugin-prod Bot commented Apr 7, 2025

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

@elasticmachine
Copy link
Copy Markdown

elasticmachine commented Apr 7, 2025

💚 Build Succeeded

History

cc @moxarth-rathod

@elastic-sonarqube
Copy link
Copy Markdown

elastic-sonarqube Bot commented Apr 7, 2025

Quality Gate passed Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

@moxarth-rathod moxarth-rathod marked this pull request as ready for review April 7, 2025 17:32
kcreddy
kcreddy reviewed Apr 9, 2025
View reviewed changes
Comment thread ..._configuration_finding/_dev/test/pipeline/test-cloud-configuration-finding.log-expected.json
"info"
]
],
"url": "https://app.wiz.io/findings/configuration-findings/cloud#~(filters~(status~()~rule~(equals~(~'73553de7-f2ad-4ffb-b425-c69815033530)))~groupBy~(~)~entity~(~'bdeba988-f41b-55e6-9b99-96b8d3dc67d4*2cCONFIGURATION_FINDING))"
Copy link
Copy Markdown
Contributor

@kcreddy kcreddy Apr 9, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It seems to me that its missing ending single-quote ' for example, '73553de7-f2ad-4ffb-b425-c69815033530 instead of '73553de7-f2ad-4ffb-b425-c69815033530'. Are these URLs working on live data? May I know if this is tested?

Copy link
Copy Markdown
Contributor Author

@moxarth-rathod moxarth-rathod Apr 10, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, this URL is in the expected format. Here is an example of Live URL:

https://app.wiz.io/findings/configuration-findings/cloud#~(filters~(status~(equals~(~'OPEN))~rule~(equals~(~'63cfa876-xxxx-xxxx-xxxx-0ab8c08dd643)))~groupBy~(~)~entity~(~'bf381c0b-xxxx-xxxx-xxxx-1e00121af5bc*2cCONFIGURATION_FINDING))

Copy link
Copy Markdown
Contributor

@kcreddy kcreddy Apr 13, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Interesting. Thank you!

@moxarth-rathod moxarth-rathod requested a review from kcreddy April 10, 2025 05:50
kcreddy
kcreddy approved these changes Apr 13, 2025
View reviewed changes
Copy link
Copy Markdown
Contributor

@kcreddy kcreddy left a comment •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@kcreddy kcreddy merged commit 72175f3 into elastic:main Apr 13, 2025
7 checks passed
@elastic-vault-github-plugin-prod
Copy link
Copy Markdown

elastic-vault-github-plugin-prod Bot commented Apr 13, 2025

Package wiz - 3.1.0 containing this change is available at https://epr.elastic.co/package/wiz/3.1.0/

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@kcreddy kcreddy kcreddy approved these changes

Assignees

@moxarth-rathod moxarth-rathod

Labels

enhancement New feature or request Integration:wiz Wiz Team:SDE-Crest Crest developers on the Security Integrations team [elastic/sit-crest-contractors] Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations]

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Link to event in Wiz system in Elastic Alert created from Wiz Agent integration

3 participants

@moxarth-rathod @elasticmachine @kcreddy