Skip to content

Commit 6aab6d1

Browse files
skywalke34skywalke34
authored
Update Wiz Parser Documentation - Standard & SCA
Update to Wiz Parser including detailed mapping between standard .csv format and SCA .csv format.
1 parent ed2b172 commit 6aab6d1

1 file changed

Lines changed: 158 additions & 4 deletions

File tree

  • docs/content/en/connecting_your_tools/parsers/file

‎docs/content/en/connecting_your_tools/parsers/file/wiz.md‎

Lines changed: 158 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,162 @@
11
---
2-
title: "Wiz Scanner"
2+
title: "Wiz Scanner Parser"
33
toc_hide: true
4+
weight: 1
45
---
5-
This parser imports scan results from [wiz](https://www.wiz.io/). You have to use Report Type *Standard* when you export the results. The file format will be .csv which is parsable within DefectDojo.
66

7-
### Sample Scan Data
8-
Sample Wiz Scanner scans can be found [here](https://github.com/DefectDojo/django-DefectDojo/tree/master/unittests/scans/wiz).
7+
# Wiz Scanner Parser Documentation
8+
9+
## Overview
10+
The [Wiz](https://www.wiz.io/) parser for DefectDojo supports both Wiz Scanner Standard CSV output and SCA (Software Composition Analysis) .csv output from Wiz.io, allowing import of Wiz.io security findings into DefectDojo. This document covers both .csv formats, including DefectDojo field mappings, unmapped fields, and location of each field's parsing code.
11+
12+
## Supported File Types
13+
The Wiz parser accepts CSV file format. There are two primary formats supported:
14+
15+
1. **Standard Format** - CSV exports with "Title" field (processed by WizParserByTitle class)
16+
2. **SCA Format** - CSV exports with "Name" and "DetailedName" fields (processed by WizParserByDetailedName class)
17+
18+
## Standard Format (WizParserByTitle)
19+
20+
### Total Fields in Standard Format CSV
21+
- Total data fields: 32
22+
- Total data fields parsed: 32
23+
- Total data fields NOT parsed: 0
24+
25+
### Standard Format Field Mapping Details
26+
27+
| CSV Field # | CSV Field | Finding Field | Parser Line # | Notes |
28+
|-------------|-----------|---------------|--------------|-------|
29+
| 1 | Created At | date | 68 | Parsed using the parse_wiz_datetime function to convert to datetime object |
30+
| 2 | Title | title | 67 | Direct mapping to Finding title |
31+
| 3 | Severity | severity | 69 | Converted to lowercase then capitalized to match DefectDojo's severity format |
32+
| 4 | Status | active, is_mitigated, mitigated | 65 | Converted through WizcliParsers.convert_status function to determine active status and mitigation status |
33+
| 5 | Description | description (partial) | 79-81 | Added to description with "Description:" prefix |
34+
| 6 | Resource Type | description (partial) | 79-81 | Added to description with "Resource Type:" prefix |
35+
| 7 | Resource external ID | description (partial) | 79-81 | Added to description with "Resource external ID:" prefix |
36+
| 8 | Subscription ID | description (partial) | 79-81 | Added to description with "Subscription ID:" prefix |
37+
| 9 | Project IDs | description (partial) | 79-81 | Added to description with "Project IDs:" prefix |
38+
| 10 | Project Names | description (partial) | 79-81 | Added to description with "Project Names:" prefix |
39+
| 11 | Resolved Time | mitigated | 71-74 | Used to set mitigated timestamp if finding is marked as mitigated |
40+
| 12 | Resolution | mitigation (partial) | 62-63 | Added to mitigation text with "Resolution:" prefix |
41+
| 13 | Control ID | description (partial) | 79-81 | Added to description with "Control ID:" prefix |
42+
| 14 | Resource Name | description (partial) | 79-81 | Added to description with "Resource Name:" prefix |
43+
| 15 | Resource Region | description (partial) | 79-81 | Added to description with "Resource Region:" prefix |
44+
| 16 | Resource Status | description (partial) | 79-81 | Added to description with "Resource Status:" prefix |
45+
| 17 | Resource Platform | description (partial) | 79-81 | Added to description with "Resource Platform:" prefix |
46+
| 18 | Resource OS | description (partial) | 79-81 | Added to description with "Resource OS:" prefix |
47+
| 19 | Resource original JSON | description (partial) | 79-81 | Added to description with "Resource original JSON:" prefix |
48+
| 20 | Issue ID | unique_id_from_tool | 85 | Used as unique identifier for the finding |
49+
| 21 | Resource vertex ID | description (partial) | 79-81 | Added to description with "Resource vertex ID:" prefix |
50+
| 22 | Ticket URLs | description (partial) | 79-81 | Added to description with "Ticket URLs:" prefix |
51+
| 23 | Note | description (partial) | 79-81 | Added to description with "Note:" prefix |
52+
| 24 | Due At | description (partial) | 79-81 | Added to description with "Due At:" prefix |
53+
| 25 | Remediation Recommendation | mitigation | 61 | Direct mapping to mitigation field |
54+
| 26 | Subscription Name | description (partial) | 79-81 | Added to description with "Subscription Name:" prefix |
55+
| 27 | Wiz URL | description (partial) | 79-81 | Added to description with "Wiz URL:" prefix |
56+
| 28 | Cloud Provider URL | description (partial) | 79-81 | Added to description with "Cloud Provider URL:" prefix |
57+
| 29 | Resource Tags | description (partial) | 79-81 | Added to description with "Resource Tags:" prefix |
58+
| 30 | Kubernetes Cluster | description (partial) | 79-81 | Added to description with "Kubernetes Cluster:" prefix |
59+
| 31 | Kubernetes Namespace | description (partial) | 79-81 | Added to description with "Kubernetes Namespace:" prefix |
60+
| 32 | Container Service | description (partial) | 79-81 | Added to description with "Container Service:" prefix |
61+
62+
### Additional Finding Field Settings (Standard Format)
63+
64+
| Finding Field | Default Value | Parser Line # | Notes |
65+
|--------------|---------------|---------------|-------|
66+
| static_finding | False | 84 | Set to False for all findings |
67+
| dynamic_finding | True | 84 | Set to True for all findings |
68+
69+
## SCA Format (WizParserByDetailedName)
70+
71+
### Total Fields in SCA CSV
72+
- Total data fields: 41
73+
- Total data fields parsed: 36
74+
- Total data fields NOT parsed: 5
75+
76+
### SCA Format Field Mapping Details
77+
78+
| CSV Field # | CSV Field | Finding Field | Parser Line # | Notes |
79+
|-------------|-----------|---------------|---------------|-------|
80+
| 1 | ID | unique_id_from_tool | 182 | Used as unique identifier for the finding |
81+
| 2 | WizURL | description | 150-154 | Added to description with "Wiz URL" prefix |
82+
| 3 | Name | title, vulnerability_ids | 169, 182-184 | Used in title format as vulnerability ID and added to vulnerability_ids list |
83+
| 4 | CVSSSeverity | Not parsed | - | Not used in mapping |
84+
| 5 | HasExploit | description | 150-154 | Added to description with "Has Exploit" prefix |
85+
| 6 | HasCisaKevExploit | description | 150-154 | Added to description with "Has Cisa Kev Exploit" prefix |
86+
| 7 | FindingStatus | active, is_mitigated | 180 | Mapped through convert_status function to determine active state |
87+
| 8 | VendorSeverity | severity | 181 | Mapped through _validate_severities to convert to DefectDojo severity format |
88+
| 9 | FirstDetected | date | 185 | Parsed into date object using date_parser |
89+
| 10 | LastDetected | Not parsed | - | Not used in mapping |
90+
| 11 | ResolvedAt | Not parsed | - | Not used in mapping |
91+
| 12 | ResolutionReason | Not parsed | - | Not used in mapping |
92+
| 13 | Remediation | mitigation | 155-159 | Added to mitigation with "Remediation" prefix |
93+
| 14 | LocationPath | description, mitigation | 150-159 | Added to both description and mitigation with "Location Path" prefix |
94+
| 15 | DetailedName | title, component_name | 169, 183 | Used in title format and mapped to component_name |
95+
| 16 | Version | description, component_version | 150-154, 184 | Added to description with "Version" prefix and mapped to component_version |
96+
| 17 | FixedVersion | mitigation | 155-159 | Added to mitigation with "Fixed Version" prefix |
97+
| 18 | DetectionMethod | description | 150-154 | Added to description with "Detection Method" prefix |
98+
| 19 | Link | description | 150-154 | Added to description with "Link" prefix |
99+
| 20 | Projects | description | 150-154 | Added to description with "Projects" prefix |
100+
| 21 | AssetID | description | 150-154 | Added to description with "Asset ID" prefix |
101+
| 22 | AssetName | description | 150-154 | Added to description with "Asset Name" prefix |
102+
| 23 | AssetRegion | description | 150-154 | Added to description with "Asset Region" prefix |
103+
| 24 | ProviderUniqueId | description | 150-154 | Added to description with "Provider Unique Id" prefix |
104+
| 25 | CloudProviderURL | description | 150-154 | Added to description with "Cloud Provider URL" prefix |
105+
| 26 | CloudPlatform | description | 150-154 | Added to description with "Cloud Platform" prefix |
106+
| 27 | Status | Not parsed | - | Not directly used (FindingStatus is used instead) |
107+
| 28 | SubscriptionExternalId | description | 150-154 | Added to description with "Subscription External Id" prefix |
108+
| 29 | SubscriptionId | description | 150-154 | Added to description with "Subscription Id" prefix |
109+
| 30 | SubscriptionName | description | 150-154 | Added to description with "Subscription Name" prefix |
110+
| 31 | Tags | unsaved_tags | 186 | Parsed into tags list using _parse_tags function |
111+
| 32 | ExecutionControllers | description | 150-154 | Added to description with "Execution Controllers" prefix |
112+
| 33 | ExecutionControllersSubscriptionExternalIds | description | 150-154 | Added to description with "Execution Controllers Subscription External Ids" prefix |
113+
| 34 | ExecutionControllersSubscriptionNames | description | 150-154 | Added to description with "Execution Controllers Subscription Names" prefix |
114+
| 35 | CriticalRelatedIssuesCount | Not parsed | - | Not used in mapping |
115+
| 36 | HighRelatedIssuesCount | Not parsed | - | Not used in mapping |
116+
| 37 | MediumRelatedIssuesCount | Not parsed | - | Not used in mapping |
117+
| 38 | LowRelatedIssuesCount | Not parsed | - | Not used in mapping |
118+
| 39 | InfoRelatedIssuesCount | Not parsed | - | Not used in mapping |
119+
| 40 | OperatingSystem | description | 150-154 | Added to description with "Operating System" prefix |
120+
| 41 | IpAddresses | description | 150-154 | Added to description with "Ip Addresses" prefix |
121+
122+
### Additional Finding Field Settings (SCA Format)
123+
124+
| Finding Field | Default Value | Parser Line # | Notes |
125+
|--------------|---------------|---------------|-------|
126+
| static_finding | True | 182 | Set to True for SCA format findings |
127+
| Severity | "Info" | 210 | Default if not a valid severity |
128+
129+
## Special Processing Notes
130+
131+
### Date Processing
132+
- Parser uses function `parse_wiz_datetime()` (lines 207-246) to handle different date formats from Wiz
133+
- Handles both ISO8601 and custom Wiz timestamp formats
134+
135+
### Status Conversion
136+
- Both parser formats use `WizcliParsers.convert_status()` function to determine finding status (active, mitigated, etc.)
137+
- Standard format - if a finding is mitigated, the Resolved Time is used as the mitigated timestamp
138+
139+
### Description Construction
140+
- Most CSV fields maintain field name as a prefix when added to the Finding description
141+
- Description generated by iterating through predefined list of fields and adding data if present
142+
143+
### Title Format
144+
- Standard format: Used directly from the "Title" field
145+
- SCA format: Combines package name (DetailedName) and vulnerability ID (Name) in format "{package_name}: {vulnerability_id}"
146+
147+
### Mitigation Construction
148+
- Standard format: Primary source is "Remediation Recommendation" field with optional "Resolution" field
149+
- SCA format: Combines "Remediation", "LocationPath", and "FixedVersion" fields
150+
151+
### Deduplication
152+
- Both formats use the respective ID field as the unique_id_from_tool for deduplication
153+
154+
### Tags Handling (SCA Format)
155+
- "Tags" field is parsed from a JSON string format into a list of tag strings in format "key: value" (lines 186, 193-201)
156+
157+
## Sample Scan Data or Unit Tests
158+
- [Sample Scan Data Folder](https://github.com/DefectDojo/django-DefectDojo/tree/master/unittests/scans/wiz)
159+
160+
## Link To Tool
161+
- [Wiz.io](https://www.wiz.io/)
162+
- [Wiz Documentation](https://docs.wiz.io/)

0 commit comments

Comments
 (0)