Page Comparison

...

The Devo Wiz collector allows customers to retrieve Wiz cloud security issues into Devo to query, correlate, analyze, and visualize to enable Enterprise IT and Cybersecurity teams to take the most impactful decisions at the petabyte scale. The collector processes the Wiz API responses and sends them to the Devo platform, which then categorizes all data received on tables along rows and columns in your Devo domain.

Data sources

Data source	Description	API

endpoint

Endpoint	Collector service name	Devo table	Available from release
Issues	An issue in

Wiz

Feature

Details

Allow parallel downloading (multipod)

Not allowed

Running environments

Collector Server, On Premise

Populated Devo events

Table

Flattening preprocessing

wiz is a vulnerability that is detected in the cloud infrastructure

/graphql

issues

cspm.wiz.issues.default

v1.0.0

Devo collector features

Vulnerability	Vulnerabilities are weaknesses in computer systems that can be exploited by malicious attackers. Whether they are caused by bugs or design flaws, vulnerabilities can allow attackers to execute code in an environment or elevate privileges.	`/graphql`	`vulnerabilities`	`cspm.wiz.vulnerabilities.default`	`v1.5.0`
Audit Logs	The Audit Log records key events in Wiz, such as login, logout, and user update. The Audit Log is primarily used to investigate potentially suspicious activity or diagnose and troubleshoot errors.	`/graphql`	`auditLogs`	`cspm.wiz.audit.default`	`v1.5.0`
Cloud Configuration Findings	This returns the problems with configurations and the remediation solutions for the same.	`/graphql`	`cloudConfiguration`	`cspm.wiz.cloud_configuration.default`	`v1.5.0`

Devo collector features

Feature	Details
Allow parallel downloading (`multipod`)	`Not allowed`
Running environments	`Collector Server`, `On Premise`
Populated Devo events	`Table`
Flattening preprocessing	`Yes`

Flattening preprocessing

...

Data source	Collector service	Optional	Flattening details
Issues	`issues`	`No`	The `control` key content is transferred to the first JSON level with the prefix `control_`. The `entity` key content is transferred to the first JSON level with the prefix `entity_`. The `entitySnapshot` key content is transferred to the first JSON level with the prefix `entitySnapshot_`.

How to enable the collection in the vendor

Minimal requirements to follow this guide

...

Vulnerabilities	`vulnerabilities`	`Yes`	The `layer` key content is transferred to the first json level with the prefix `layer_`. The `vulnerable_asset` key content is transferred to the first json level with the prefix `asset_`.
Audit Logs	`auditLogs`	`Yes`	The `action_parameters` key content is transferred to the first json level with the prefix `action_`.
Cloud Configuration Findings	`cloudConfiguration`	`Yes`	The `resource` key content is transferred to the first json level with the prefix `resource_`.

How to enable the collection in the vendor

Minimal requirements to follow this guide

In order to retrieve the data, the following details will be required from your Wiz instance.

...

By default, the base url is https://api.us1.app.wiz.io. This parameter allows you to customize the base url.

Rw ui tabs macro

Rw tab

title	Cloud collector

We use a piece of software called Collector Server to host and manage all our available collectors.

To enable the collector for a customer:

In the Collector Server GUI, access the domain in which you want this instance to be created
Click Add Collector and find the one you wish to add.
In the Version field, select the latest value.
In the Collector Name field, set the value you prefer (this name must be unique inside the same Collector Server domain).
In the sending method select Direct Send. Direct Send configuration is optional for collectors that create Table events, but mandatory for those that create Lookups.
In the Parameters section, establish the Collector Parameters as follows below:

Editing the JSON configuration

Code Block

{
  "global_overrides": {
    "debug": <debug_status>
  },
  "inputs": {
    "wiz_data_puller": {
      "id": "<short_unique_id>",
      "enabled": <input_status>,
      "override_api_base_url": <base_url>,
      "credentials": {
        "client_id": "<client_id>",
        "client_secret": "<client_secret>"
      },
      "services": {
        "issues": {
          "request_period_in_seconds": <request_period_in_seconds>,
          "historic_date_utc": <historic_date_utc>,
          "filters": {
            "type": <type_list>
          }
        },
        "vulnerabilities": {
 }     }   }
}

Info
All defined service entities will be executed by the collector. If you do not want to run any of them, just remove the entity from the `services` object.

Please replace the placeholders with real world values following the description table below:

Parameter

Data Type

Type

Value Range / Format

Details

debug_status

bool

Mandatory

false / true

If the value is true, the debug logging traces will be enabled when running the collector. If the value is false, only the info, warning and error logging levels will be printed.

short_unique_id

int

Mandatory

Minimum length: 1
Maximum length: 5

Use this param to give an unique id to this input service.

Note
This parameter is used to build the persistence address, do not use the same value for multiple collectors. It could cause a collision.

input_status

bool

Mandatory

false / true

Use this param to enable or disable the given input logic when running the collector. If the value is true, the input will be run. If the value is false, it will be ignored.

base_url

str

Optional

Valid URL following this regex:
^https:\/\/([a-z0-9]+[.]{1})([a-z0-9]+[.]{1})*[a-z]{2,}(:[0-9]{2,5})?$

 "request_period_in_seconds": <request_period_in_seconds>,
          "historic_date_utc": <historic_date_utc>
        },
        "auditLogs": {
          "request_period_in_seconds": <request_period_in_seconds>,
          "historic_date_utc": <historic_date_utc>
        },
        "cloudConfiguration": {
          "request_period_in_seconds": <request_period_in_seconds>,
          "historic_date_utc": <historic_date_utc>
        }
      }
    }
  }
}

Info
All defined service entities will be executed by the collector. If you do not want to run any of them, just remove the entity from the `services` object.

Please replace the placeholders with real world values following the description table below:

Parameter

Data Type

Type

Value Range / Format

Details

debug_status

bool

Mandatory

false / true

If the value is true, the debug logging traces will be enabled when running the collector. If the value is false, only the info, warning and error logging levels will be printed.

short_unique_id

int

Mandatory

Minimum length: 1
Maximum length: 5

Use this param to give an unique id to this input service.

Note
This parameter is used to build the persistence address, do not use the same value for multiple collectors. It could cause a collision.

input_status

bool

Mandatory

false / true

Use this param to enable or disable the given input logic when running the collector. If the value is true, the input will be run. If the value is false, it will be ignored.

base_url

str

Optional

Valid URL following this regex:
^https:\/\/([a-z0-9]+[.]{1})([a-z0-9]+[.]{1})*[a-z]{2,}(:[0-9]{2,5})?$

By default, the base url is https://api.us1.app.wiz.io. This parameter allows you to customize the base url.

This parameter should be removed if it is not used.

historic_date_utc

str

Optional

UTC with format:
YYYY-mm-ddTHH:MM:SS.sssZ

This configuration allows you to set a custom date as the beginning of the period to download. This allows downloading historical data (1 month back for example) before downloading new events.

If this setting is not set, the default value is the current time.

This parameter should be removed if it is not used.

client_id

str

Mandatory

Any

User Client ID to authenticate to the service.

client_secret

str

Mandatory

Any

User Secret Key to authenticate to the service.

request_period_in_seconds

int

Optional

Minimum length: 1

Period in seconds used between each data pulling, this value will overwrite the default value (60 seconds)

This parameter should be removed if it is not used.

historictype_date_utclist

strlist

Optional

UTC with format:
YYYY-mm-ddTHH:MM:SS.sssZ

This configuration allows you to set a custom date as the beginning of the period to download. This allows downloading historical data (1 month back for example) before downloading new events.

If this setting is not set, the default value is the current time.Possible values:

"TOXIC_COMBINATION"
"THREAT_DETECTION",
"CLOUD_CONFIGURATION"

Filter by Issue type. You can specify multiple values in an array.

Example 1:

Code Block
"type": ["THREAT_DETECTION"]

Example 2 (multiple values):

Code Block
"type": ["TOXIC_COMBINATION", "THREAT_DETECTION"]

This parameter should be removed if it is not used.

clientoverride_tag_idvalue

str

MandatoryOptional

Any

User Client ID to authenticate to the service.

client_secret

str

Mandatory

Any

User Secret Key to authenticate to the service.

request_period_in_seconds

int

Optional

Minimum length: 1

Period in seconds used between each data pulling, this value will overwrite the default value (60 seconds)

This parameter should be removed if it is not used.

type_list

list

Optional

Possible values:

"TOXIC_COMBINATION"
"THREAT_DETECTION",
"CLOUD_CONFIGURATION"

Filter by Issue type. You can specify multiple values in an array.

Example 1:

Code Block
"type": ["THREAT_DETECTION"]

Example 2 (multiple values):

Code Block
"type": ["TOXIC_COMBINATION", "THREAT_DETECTION"]

This parameter should be removed if it is not used.

Rw tab

title	On-premise collector

This data collector can be run in any machine that has the Docker service available because it should be executed as a docker container. The following sections explain how to prepare all the required setup for having the data collector running.

Structure

The following directory structure should be created for being used when running the collector:

Code Block

<any_directory>
└── devo-collectors/
    └── <product_name>/
        ├── certs/
        │   ├── chain.crt
        │   ├── <your_domain>.key
        │   └── <your_domain>.crt
        ├── state/
        └── config/ 
            └── config-<product_name>.yaml

Note
Replace `<product_name>` with the proper value.

Devo credentials

In Devo, go to Administration → Credentials → X.509 Certificates, download the Certificate, Private key and Chain CA and save them in <product_name>/certs/. Learn more about security credentials in Devo here.

Image Removed

Replace <product_name> with the proper value.

Editing the config.yaml file

Code Blockglobals: debug: <debug_status> id: <collector_id> name: <collector_name> persistence: type: filesystem config: directory_name: state multiprocessing: false queue_max_size_in_mb: 1024 queue_max_size_in_messages: 1000 queue_max_elapsed_time_in_sec: 60 queue_wrap_max_size_in_messages: 100 outputs: devo_1: type: devo_platform config: address: <devo_address> port: 443 type: SSL chain: <chain_filename> cert: <cert_filename> key: <key_filename> inputs: wiz_data_puller: id: <short_unique_id> enabled: <input_status> override_api_base_url: <base_url> credentials: client_id: <client_id> client_secret: <client_secret> services: issues

Devo Tag

Use this to override Devo tag.

Rw tab

title	On-premise collector

This data collector can be run in any machine that has the Docker service available because it should be executed as a docker container. The following sections explain how to prepare all the required setup for having the data collector running.

Structure

The following directory structure should be created for being used when running the collector:

Code Block

<any_directory>
└── devo-collectors/
    └── <product_name>/
        ├── certs/
        │   ├── chain.crt
        │   ├── <your_domain>.key
        │   └── <your_domain>.crt
        ├── state/
        └── config/ 
            └── config-<product_name>.yaml

Note
Replace `<product_name>` with the proper value.

Devo credentials

In Devo, go to Administration → Credentials → X.509 Certificates, download the Certificate, Private key and Chain CA and save them in <product_name>/certs/. Learn more about security credentials in Devo here.

Image Added

Replace <product_name> with the proper value.

Editing the config.yaml file

Code Block

globals:
  debug: <debug_status>
  id: <collector_id>
  name: <collector_name>
  persistence:
    type: filesystem
    config:
      directory_name: state
  multiprocessing: false
  queue_max_size_in_mb: 1024
  queue_max_size_in_messages: 1000
  queue_max_elapsed_time_in_sec: 60
  queue_wrap_max_size_in_messages: 100

outputs:
  devo_1:
    type: devo_platform
    config:
      address: <devo_address>
      port: 443
      type: SSL
      chain: <chain_filename>
      cert: <cert_filename>
      key: <key_filename>

inputs:
  wiz_data_puller:
    id: <short_unique_id>
    enabled: <input_status>
    override_api_base_url: <base_url>
    credentials:
      client_id: <client_id>
      client_secret: <client_secret>
    services:
      issues:
        request_period_in_seconds: <request_period_in_seconds>
        historic_date_utc: <historic_date_utc>
        filters:
          type: <type_list>
        override_devo_tag : <override_tag_value>
      vulnerabilities:
        request_period_in_seconds: <request_period_in_seconds>
        historic_date_utc: <historic_date_utc>
        override_devo_tag: <override_tag_value>
      auditLogs:
        request_period_in_seconds: <request_period_in_seconds>
        historic_date_utc: <historic_date_utc>
        override_devo_tag: <override_tag_value>
      cloudConfiguration:
        request_period_in_seconds: <request_period_in_seconds>
        historic_date_utc: <historic_date_utc>
        filters:
          type: <type_list>override_devo_tag: <override_tag_value>

Info
All defined service entities will be executed by the collector. If you do not want to run any of them, just remove the entity from the `services` object.

Replace the placeholders with your required values following the description table below:

Parameter

Data type

Type

Value range

Details

debug_status

bool

Mandatory

false / true

If the value is true, the debug logging traces will be enabled when running the collector. If the value is false, only the info, warning and error logging levels will be printed.

collector_id

int

Mandatory

Minimum length: 1
Maximum length: 5

Use this param to give an unique id to this collector.

collector_name

str

Mandatory

Minimum length: 1
Maximum length: 10

Use this param to give a valid name to this collector.

devo_address

str

Mandatory

collector-us.devo.io
collector-eu.devo.io

Use this param to identify the Devo Cloud where the events will be sent.

chain_filename

str

Mandatory

Minimum length: 4
Maximum length: 20

Use this param to identify the chain.cert file downloaded from your Devo domain. Usually this file's name is: chain.crt

cert_filename

str

Mandatory

Minimum length: 4
Maximum length: 20

Use this param to identify the file.cert downloaded from your Devo domain.

key_filename

str

Mandatory

Minimum length: 4
Maximum length: 20

Use this param to identify the file.key downloaded from your Devo domain.

short_unique_id

int

Mandatory

Minimum length: 1
Maximum length: 5

Use this param to give an unique id to this input service.

Note
This parameter is used to build the persistence address, do not use the same value for multiple collectors. It could cause a collision.

input_status

bool

Mandatory

false / true

Use this param to enable or disable the given input logic when running the collector. If the value is true, the input will be run. If the value is false, it will be ignored.

requests_per_seconds

int

Optional

Minimum value: 1

Customize the maximum number of API requests per second. If not used, the default setting will be used: 100000 requests/sec.

Info
This parameter can be left blank, removed or commented.

base_url

str

Optional

Valid URL following this regex:
^https:\/\/([a-z0-9]+[.]{1})([a-z0-9]+[.]{1})*[a-z]{2,}(:[0-9]{2,5})?$

By default, the base url is https://api.us1.app.wiz.io. This parameter allows you to customize the base url.

Info
This parameter can be left blank, removed or commented.

historic_date_utc

str

Optional

UTC with format:
YYYY-mm-ddTHH:MM:SS.sssZ

This configuration allows you to set a custom date as the beginning of the period to download. This allows downloading historical data (1 month back for example) before downloading new events.

If this setting is not set, the default value is the current time.

Note
Note that update this value triggers the clearing of the Collector’s persistence and cannot be recovered in any way. Resetting persistence could result in duplicate or lost events.

Info
This parameter can be removed or commented.

client_id

str

Mandatory

Any

User Client ID to authenticate to the service.

client_secret

str

Mandatory

Any

User Secret Key to authenticate to the service.

request_period_in_seconds

int

Optional

Minimum length: 1

Period in seconds used between each data pulling, this value will overwrite the default value (60 seconds)

Info
This parameter can be removed or commented.

type_list

list

Optional

Possible values:

"TOXIC_COMBINATION"
"THREAT_DETECTION",
"CLOUD_CONFIGURATION"

Filter by Issue type. You can specify multiple values in an array.

Example 1:

Code Block
type: - THREAT_DETECTION

Example 2 (multiple values):

Code Block
type: - TOXIC_COMBINATION - THREAT_DETECTION

This parameter should be removed if it is not used.

override_tag_value

str

Optional

Devo Tag

Use this to override Devo tag.

Download the Docker image

The collector should be deployed as a Docker container. Download the Docker image of the collector as a .tgz file by clicking the link in the following table:

Collector Docker image	SHA-256 hash
collecto-wiz-docker-image-1.45.0.tgz	`b9e82a00676ade05561e403f5ccaa7561b66dd384c74de76d29680c93a3262ceeede9ca2ede82971483d80a5da6b93073f3afb528251a534930e2a05d6be807d`

Use the following command to add the Docker image to the system:

Code Block
gunzip -c <image_file>-<version>.tgz \| docker load

Note
Once the Docker image is imported, it will show the real name of the Docker image (including version info). Replace `<image_file>` and `<version>` with a proper value.

The Docker image can be deployed on the following services:

Docker

Execute the following command on the root directory <any_directory>/devo-collectors/<product_name>/

Code Block

docker run 
--name collector-<product_name> 
--volume $PWD/certs:/devo-collector/certs 
--volume $PWD/config:/devo-collector/config 
--volume $PWD/state:/devo-collector/state 
--env CONFIG_FILE=config.yaml 
--rm 
--interactive 
--tty 
<image_name>:<version>

Note
Replace `<product_name>`, `<image_name>` and `<version>` with the proper values.

Docker Compose

The following Docker Compose file can be used to execute the Docker container. It must be created in the <any_directory>/devo-collectors/<product_name>/ directory.

Code Block

version: '3'
services:
  collector-<product_name>:
    image: <image_name>:${IMAGE_VERSION:-latest}
    container_name: collector-<product_name>
    volumes:
      - ./certs:/devo-collector/certs
      - ./config:/devo-collector/config
      - ./credentials:/devo-collector/credentials
      - ./state:/devo-collector/state
    environment:
      - CONFIG_FILE=${CONFIG_FILE:-config.yaml}

To run the container using docker-compose, execute the following command from the <any_directory>/devo-collectors/<product_name>/ directory:

Code Block
IMAGE_VERSION=<version> docker-compose up -d

Note
Replace `<product_name>`, `<image_name>` and `<version>` with the proper values.

...

Release

Released on

Release type

Details

Recommendations

v1.5.0

15 Feb 2024

Status

colour	Green
title	FEATURE

Status

colour	Yellow
title	IMPROVEMENTS

New Features

Added following three new services:
- Vulnerabilities
- Audit Logs
- Cloud Configuration Findings

Improvements

Upgraded DCSDK from 1.10.2 to 1.10.3 .

Upgrade

v1.4.0

20 Nov 2023

Status

colour	Green
title	FEATURE

Status

colour	Yellow
title	IMPROVEMENTS

New Features

Added extra filters for events:
- type: Filter by Issue type. You can specify multiple values in an array.
  - Possible values: ["TOXIC_COMBINATION", "THREAT_DETECTION", "CLOUD_CONFIGURATION"]

Improvements

Upgraded DCSDK from 1.9.2 to 1.10.2
- Added input metrics
- Modified ouutput metrics
- Updated DevoSDK to version 5.1.6
- Standardized exception messages for traceability
- Added more detail in queue statistics
- Updated PythonSDK to version 5.0.7
- Introduced pyproject.toml
- Added requirements.dev.txt
- Fixed error in pyproject.toml related to project scripts endpoint

Recommended

v1.3.0

30 Oct 2023

Status

colour	Red
title	BUG FIX

Status

colour	Yellow
title	IMPROVEMENTS

Improvements:

Upgraded DCSDK from 1.9.1 to 1.9.2
- upgraded dependencies

Bug Fix:

Remove actions from service tables

Recommended

v1.2.0

23 Aug 2023

Status

colour	Yellow
title	IMPROVEMENTS

Improvements:

Upgraded DCSDK from 1.3.0 to 1.9.1
- Store lookup instances into DevoSender to avoid creation of new instances for the same lookup
- Ensure service_config is a dict into templates
- Ensure special characters are properly sent to the platform
- Changed log level to some messages from info to debug
- Changed some wrong log messages
- Upgraded some internal dependencies
- Changed queue passed to setup instance constructor
- Added log traces for knowing the execution environment status (debug mode)
- Fixes in the current puller template version
- Improved log trace details when runtime exceptions happen
- Refactored source code structure
- New “templates” functionality
- Functionality for detecting some system signals for starting the controlled stopping
- Input objects sends again the internal messages to devo.collectors.out table
- Upgraded DevoSDK to version 3.6.4 to fix a bug related to a connection loss with Devo
- Refactored source code structure
- Changed way of executing the controlled stopping
- Minimized probabilities of suffering a DevoSDK bug related to “sender” to be null
- Ability to validate collector setup and exit without pulling any data
- Ability to store in the persistence the messages that couldn’t be sent after the collector stopped
- Ability to send messages from the persistence when the collector starts and before the puller begins working
- Ensure special characters are properly sent to the platform
- Added a lock to enhance sender object
- Added new class attrs to the __setstate__ and __getstate__ queue methods
- Fix sending attribute value to the __setstate__ and __getstate__ queue methods
- Added log traces when queues are full and have to wait
- Added log traces of queues time waiting every minute in debug mode
- Added method to calculate queue size in bytes
- Block incoming events in queues when there are no space left
- Send telemetry events to Devo platform
- Upgraded internal Python dependency Redis to v4.5.4
- Upgraded internal Python dependency DevoSDK to v5.1.3
- Fixed obfuscation not working when messages are sent from templates
- New method to figure out if a puller thread is stopping
- Upgraded internal Python dependency DevoSDK to v5.0.6
- Improved logging on messages/bytes sent to Devo platform
- Fixed wrong bytes size calculation for queues
- New functionality to count bytes sent to Devo Platform (shown in console log)
- Upgraded internal Python dependency DevoSDK to v5.0.4
- Fixed bug in persistence management process, related to persistence reset
- Aligned source code typing to be aligned with Python 3.9.x
- Inject environment property from user config
- Obfuscation service can be now configured from user config and module definition
- Obfuscation service can now obfuscate items inside arrays
- Ensure special characters are properly sent to the platform
- The resilience has been improved with a new feature that restart the collector when the Devo connections is lost and it cannot be recovered.
- When an exception is raised by the Collector Setup, the collector retries after 5 seconds. For consecutive exceptions, the waiting time is multiplied by 5 until hits 1800 seconds, which is the maximum waiting time allowed. No maximum retries are applied.
- When an exception is raised by the Collector Pull method, the collector retries after 5 seconds. For consecutive exceptions, the waiting time is multiplied by 5 until hits 1800 seconds, which is the maximum waiting time allowed. No maximum retries are applied.
- When an exception is raised by the Collector pre-pull method, the collector retries after 30 seconds. No maximum retries are applied.
- Changed log level to some messages from info to debug
- Changed some wrong log messages
- Upgraded some internal dependencies
- Changed queue passed to setup instance constructor

Upgrade

v1.1.1

07 Oct 2022

Status

colour	Red
title	BUG FIX

Bug fixes:

Force using always UTC timezone for all date time operations.

Recommended version

v1.1.0

21 Jul 2022

Status

colour	Green
title	FEATURE

New features:

Wiz’s new authentication via Cognito is now available. Former authentication using Auth0 is also still compatible.

Recommended version

v1.0.0

01 Jul 2022

Status

colour	Green
title	FEATURE

New features:

Wiz issues

Upgrade

...

Versions Compared

Old Version 16

New Version 17

Key

Data sources

Devo collector features

Devo collector features

Flattening preprocessing

How to enable the collection in the vendor

Minimal requirements to follow this guide

How to enable the collection in the vendor

Minimal requirements to follow this guide

Editing the JSON configuration

Structure

Devo credentials

Editing the config.yaml file

Structure

Devo credentials

Editing the config.yaml file

Download the Docker image

Docker

Docker Compose

New Features

Improvements

New Features

Improvements