Wiz

Our Wiz integration allows you to import projects, issues, controls, and serviceTickets from your Wiz account into Port, according to your mapping and definitions.

Common use cases

• Map projects, issues, controls, and serviceTickets in your Wiz organization environment.
• Watch for object changes (create/update/delete) in real-time, and automatically apply the changes to your entities in Port.

Prerequisites

Port Credentials

To get your Port API credentials go to your Port application, click on the ... button in the top right corner, and select Credentials. Here you can view and copy your CLIENT_ID and CLIENT_SECRET:

Wiz Credentials

You need the following connection details to configure Wiz:

• Wiz API URL (API Endpoint URL)
• Wiz Token URL
• Client ID and Client Secret

Wiz Token URL

There are two possible endpoints depending on your service account's identity provider:

• Amazon Cognito: https://auth.app.wiz.io/oauth/token
• Auth0: https://auth.wiz.io/oauth/token

Learn more here.

1. Finding Your Wiz API URL:
   • Login to Wiz account.
   • Click the User Profile icon available at the top right of the screen and click the User Settings option.
   • Click the Tenant option from the left options menu.
   • The system displays the API Endpoint URL.
   • Copy and save the API URL to use while configuring the Wiz intergration.

For more details, refer to the documentation

2. Getting the Client ID and Client Secret

You must create a service account in Wiz to generate the Client ID and Client Secret. Follow the below steps to get the Client ID and Client Secret:

• Login to Wiz with the Project Admin role.
• Click the Settings icon available at the top-right of the page.

• On the Settings page, Click Service Accounts from the left menu.
• Create a Service Account:
  • Click Add Service Account.
  • Provide a descriptive Service Account Name.
  • Type: Select Custom Integration (GraphQL API).
  • Project: Choose the relevant project(s).
  • API Scopes: Select only the read:projects and read:issues permissions.
  • Click Add Service Account at the bottom of the page to save.

• Retrieve Credentials: Wiz will display your Client ID and Client Secret.
• Save Credentials: Copy and store them securely for use in Port.

Installation

Choose one of the following installation methods:

Real Time & Always On

Using this installation option means that the integration will be able to update Port in real time using webhooks.

This table summarizes the available parameters for the installation. Set them as you wish in the script below, then copy it and run it in your terminal:

Parameter	Description	Required
port.clientId	Your port client id (Get the credentials)	✅
port.clientSecret	Your port client secret (Get the credentials)	✅
integration.identifier	Change the identifier to describe your integration	✅
integration.type	The integration type	✅
integration.eventListener.type	The event listener type	✅
integration.secrets.wizClientId	The Wiz Client ID	✅
integration.secrets.wizClientSecret	The Wiz Client Secret	✅
integration.config.wizApiUrl	The Wiz API URL.	✅
integration.config.wizTokenUrl	The Wiz Token Authentication URL	✅
integration.config.appHost	The host of the Port Ocean app. Used to set up the integration endpoint as the target for Webhooks created in Wiz	❌
integration.secret.wizWebhookVerificationToken	This is a password you create, that is used to verify webhook events to Port	❌
scheduledResyncInterval	The number of minutes between each resync	❌
initializePortResources	Default true, When set to true the integration will create default blueprints and the port App config Mapping	❌

Helm

To install the integration using Helm, run the following command:

helm repo add --force-update port-labs https://port-labs.github.io/helm-charts
helm upgrade --install my-wiz-integration port-labs/port-ocean \
	--set port.clientId="PORT_CLIENT_ID"  \
	--set port.clientSecret="PORT_CLIENT_SECRET"  \
	--set initializePortResources=true  \
	--set scheduledResyncInterval=120 \
	--set integration.identifier="my-wiz-integration"  \
	--set integration.type="wiz"  \
	--set integration.eventListener.type="POLLING"  \
	--set integration.secrets.wizClientId="WIZ_CLIENT_ID"  \
	--set integration.secrets.wizClientSecret="WIZ_CLIENT_SECRET" \
        --set integration.secrets.wizApiUrl="WIZ_API_URL"  \
	--set integration.config.wizTokenUrl="WIZ_TOKEN_URL"  

ArgoCD

To install the integration using ArgoCD, follow these steps:

1. Create a values.yaml file in argocd/my-ocean-wiz-integration in your git repository with the content:

note

Remember to replace the placeholders for WIZ_CLIENT_ID, WIZ_CLIENT_SECRET, WIZ_API_URL and WIZ_TOKEN_URL.

initializePortResources: true
scheduledResyncInterval: 120
integration:
  identifier: my-ocean-wiz-integration
  type: wiz
  eventListener:
    type: POLLING
  config:
    wizApiUrl: WIZ_API_URL
    wizTokenUrl: WIZ_TOKEN_URL
  secrets:
    wizClientId: WIZ_CLIENT_ID
    wizClientSecret: WIZ_CLIENT_SECRET

2. Install the my-ocean-wiz-integration ArgoCD Application by creating the following my-ocean-wiz-integration.yaml manifest:

note

Remember to replace the placeholders for YOUR_PORT_CLIENT_ID YOUR_PORT_CLIENT_SECRET and YOUR_GIT_REPO_URL.

Multiple sources ArgoCD documentation can be found here.

ArgoCD Application

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: my-ocean-wiz-integration
  namespace: argocd
spec:
  destination:
    namespace: my-ocean-wiz-integration
    server: https://kubernetes.default.svc
  project: default
  sources:
  - repoURL: 'https://port-labs.github.io/helm-charts/'
    chart: port-ocean
    targetRevision: 0.1.14
    helm:
      valueFiles:
      - $values/argocd/my-ocean-wiz-integration/values.yaml
      parameters:
        - name: port.clientId
          value: YOUR_PORT_CLIENT_ID
        - name: port.clientSecret
          value: YOUR_PORT_CLIENT_SECRET
  - repoURL: YOUR_GIT_REPO_URL
    targetRevision: main
    ref: values
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
    - CreateNamespace=true

3. Apply your application manifest with kubectl:

kubectl apply -f my-ocean-wiz-integration.yaml

Scheduled

GitHub

This workflow will run the Wiz integration once and then exit, this is useful for scheduled ingestion of data.

warning

If you want the integration to update Port in real time using webhooks you should use the Real Time & Always On installation option

Make sure to configure the following Github Secrets:

Parameter	Description	Required
OCEAN__INTEGRATION__CONFIG__WIZ_CLIENT_ID	The Wiz Client ID token	✅
OCEAN__INTEGRATION__CONFIG__WIZ_CLIENT_SECRET	The Wiz Client Secret	✅
OCEAN__INTEGRATION__CONFIG__WIZ_API_URL	The Wiz API URL e.g. https://api.us17.app.wiz.io/graphql	✅
OCEAN__INTEGRATION__CONFIG__WIZ_TOKEN_URL	The Wiz Token URL e.g. https://auth.app.wiz.io/oauth/token	✅
OCEAN__INTEGRATION__CONFIG__WIZ_WEBHOOK_VERIFICATION_TOKEN	The token used to verify webhook requests into Port.	❌
OCEAN__INITIALIZE_PORT_RESOURCES	Default true, When set to false the integration will not create default blueprints and the port App config Mapping	❌
OCEAN__INTEGRATION__IDENTIFIER	Provide a unique identifier for your integration. If not provided, the default identifier will be used.	❌
OCEAN__PORT__CLIENT_ID	Your port client id (Get the credentials)	✅
OCEAN__PORT__CLIENT_SECRET	Your port client secret (Get the credentials)	✅
OCEAN__PORT__BASE_URL	Your port base url, relevant only if not using the default port app	❌

Here is an example for wiz-integration.yml workflow file:

name: Wiz Exporter Workflow

# This workflow responsible for running Wiz exporter.

on:
  workflow_dispatch:

jobs:
  run-integration:
    runs-on: ubuntu-latest

    steps:
      - uses: port-labs/ocean-sail@v1
        with:
          type: 'wiz'
          port_client_id: ${{ secrets.OCEAN__PORT__CLIENT_ID }}
          port_client_secret: ${{ secrets.OCEAN__PORT__CLIENT_SECRET }}
          config: |
            wiz_client_id: ${{ secrets.OCEAN__INTEGRATION__CONFIG__WIZ_CLIENT_ID }}
            wiz_client_secret: ${{ secrets.OCEAN__INTEGRATION__CONFIG__WIZ_CLIENT_SECRET }}
            wiz_api_url: ${{ secrets.OCEAN__INTEGRATION__CONFIG__WIZ_API_URL }}
            wiz_token_url: ${{ secrets.OCEAN__INTEGRATION__CONFIG__WIZ_TOKEN_URL }}

Jenkins

This pipeline will run the Wiz integration once and then exit, this is useful for scheduled ingestion of data.

tip

Your Jenkins agent should be able to run docker commands.

warning

If you want the integration to update Port in real time using webhooks you should use the Real Time & Always On installation option.

Make sure to configure the following Jenkins Credentials of Secret Text type:

Parameter	Description	Required
OCEAN__INTEGRATION__CONFIG__WIZ_CLIENT_ID	The Wiz Client ID token	✅
OCEAN__INTEGRATION__CONFIG__WIZ_CLIENT_SECRET	The Wiz Client Secret	✅
OCEAN__INTEGRATION__CONFIG__WIZ_API_URL	The Wiz API URL e.g. https://api.us17.app.wiz.io/graphql	✅
OCEAN__INTEGRATION__CONFIG__WIZ_TOKEN_URL	The Wiz Token URL e.g. https://auth.app.wiz.io/oauth/token	✅
OCEAN__INTEGRATION__CONFIG__WIZ_WEBHOOK_VERIFICATION_TOKEN	The token used to verify webhook requests into Port.	❌
OCEAN__INITIALIZE_PORT_RESOURCES	Default true, When set to false the integration will not create default blueprints and the port App config Mapping	❌
OCEAN__INTEGRATION__IDENTIFIER	Provide a unique identifier for your integration. If not provided, the default identifier will be used.	❌
OCEAN__PORT__CLIENT_ID	Your port client id (Get the credentials)	✅
OCEAN__PORT__CLIENT_SECRET	Your port client secret (Get the credentials)	✅
OCEAN__PORT__BASE_URL	Your port base url, relevant only if not using the default port app	❌

Here is an example for Jenkinsfile groovy pipeline file:

pipeline {
    agent any

    stages {
        stage('Run Wiz Integration') {
            steps {
                script {
                    withCredentials([
                        string(credentialsId: 'OCEAN__INTEGRATION__CONFIG__WIZ_CLIENT_ID', variable: 'OCEAN__INTEGRATION__CONFIG__WIZ_CLIENT_ID'),
                        string(credentialsId: 'OCEAN__INTEGRATION__CONFIG__WIZ_CLIENT_SECRET', variable: 'OCEAN__INTEGRATION__CONFIG__WIZ_CLIENT_SECRET'),
                        string(credentialsId: 'OCEAN__INTEGRATION__CONFIG__WIZ_API_URL', variable: 'OCEAN__INTEGRATION__CONFIG__WIZ_API_URL'),
                        string(credentialsId: 'OCEAN__INTEGRATION__CONFIG__WIZ_TOKEN_URL', variable: 'OCEAN__INTEGRATION__CONFIG__WIZ_TOKEN_URL'),
                        string(credentialsId: 'OCEAN__PORT__CLIENT_ID', variable: 'OCEAN__PORT__CLIENT_ID'),
                        string(credentialsId: 'OCEAN__PORT__CLIENT_SECRET', variable: 'OCEAN__PORT__CLIENT_SECRET'),
                    ]) {
                        sh('''
                            #Set Docker image and run the container
                            integration_type="wiz"
                            version="latest"
                            image_name="ghcr.io/port-labs/port-ocean-${integration_type}:${version}"
                            docker run -i --rm --platform=linux/amd64 \
                                -e OCEAN__EVENT_LISTENER='{"type":"ONCE"}' \
                                -e OCEAN__INITIALIZE_PORT_RESOURCES=true \
                                -e OCEAN__INTEGRATION__CONFIG__WIZ_CLIENT_ID=$OCEAN__INTEGRATION__CONFIG__WIZ_CLIENT_ID \
                                -e OCEAN__INTEGRATION__CONFIG__WIZ_CLIENT_SECRET=$OCEAN__INTEGRATION__CONFIG__WIZ_CLIENT_SECRET \
                                -e OCEAN__INTEGRATION__CONFIG__WIZ_API_URL=$OCEAN__INTEGRATION__CONFIG__WIZ_API_URL \
                                -e OCEAN__INTEGRATION__CONFIG__WIZ_TOKEN_URL=$OCEAN__INTEGRATION__CONFIG__WIZ_TOKEN_URL \
                                -e OCEAN__PORT__CLIENT_ID=$OCEAN__PORT__CLIENT_ID \
                                -e OCEAN__PORT__CLIENT_SECRET=$OCEAN__PORT__CLIENT_SECRET \
                                $image_name

                            exit $?
                        ''')
                    }
                }
            }
        }
    }
}

Azure Devops

This pipeline will run the Wiz integration once and then exit, this is useful for scheduled ingestion of data.

tip

Your Azure Devops agent should be able to run docker commands. Learn more about agents here.

warning

If you want the integration to update Port in real time using webhooks you should use the Real Time & Always On installation option.

Configure the variables in a variable group

Variable groups store values and secrets you'll use in your pipelines across your project. Learn more

Setting Up Your Credentials

1. Create a Variable Group: Name it port-ocean-credentials. Store the required variables from the table.
2. Authorize Your Pipeline:
   • Go to "Library" -> "Variable groups."
   • Find port-ocean-credentials and click on it.
   • Select "Pipeline Permissions" and add your pipeline to the authorized list.

Parameter	Description	Required
OCEAN__INTEGRATION__CONFIG__WIZ_CLIENT_ID	The Wiz Client ID token	✅
OCEAN__INTEGRATION__CONFIG__WIZ_CLIENT_SECRET	The Wiz Client Secret	✅
OCEAN__INTEGRATION__CONFIG__WIZ_API_URL	The Wiz API URL e.g. https://api.us17.app.wiz.io/graphql	✅
OCEAN__INTEGRATION__CONFIG__WIZ_TOKEN_URL	The Wiz Token URL e.g. https://auth.app.wiz.io/oauth/token	✅
OCEAN__INTEGRATION__CONFIG__WIZ_WEBHOOK_VERIFICATION_TOKEN	The token used to verify webhook requests into Port.	❌
OCEAN__INITIALIZE_PORT_RESOURCES	Default true, When set to false the integration will not create default blueprints and the port App config Mapping	❌
OCEAN__INTEGRATION__IDENTIFIER	Provide a unique identifier for your integration. If not provided, the default identifier will be used.	❌
OCEAN__PORT__CLIENT_ID	Your port client id (Get the credentials)	✅
OCEAN__PORT__CLIENT_SECRET	Your port client secret (Get the credentials)	✅
OCEAN__PORT__BASE_URL	Your port base url, relevant only if not using the default port app	❌

Here is an example for wiz-integration.yml pipeline file:

trigger:
- main

pool:
  vmImage: "ubuntu-latest"

variables:
  - group: port-ocean-credentials


steps:
- script: |
    # Set Docker image and run the container
    integration_type="wiz"
    version="latest"

    image_name="ghcr.io/port-labs/port-ocean-$integration_type:$version"

    docker run -i --rm \
        -e OCEAN__EVENT_LISTENER='{"type":"ONCE"}' \
        -e OCEAN__INITIALIZE_PORT_RESOURCES=true \
        -e OCEAN__INTEGRATION__CONFIG__WIZ_CLIENT_ID=$(OCEAN__INTEGRATION__CONFIG__WIZ_CLIENT_ID) \
        -e OCEAN__INTEGRATION__CONFIG__WIZ_CLIENT_SECRET=$(OCEAN__INTEGRATION__CONFIG__WIZ_CLIENT_SECRET) \
        -e OCEAN__INTEGRATION__CONFIG__WIZ_API_URL=$(OCEAN__INTEGRATION__CONFIG__WIZ_API_URL) \
        -e OCEAN__INTEGRATION__CONFIG__WIZ_TOKEN_URL=$(OCEAN__INTEGRATION__CONFIG__WIZ_TOKEN_URL) \
        -e OCEAN__PORT__CLIENT_ID=$(OCEAN__PORT__CLIENT_ID) \
        -e OCEAN__PORT__CLIENT_SECRET=$(OCEAN__PORT__CLIENT_SECRET) \
        $image_name

    exit $?
  displayName: 'Ingest Data into Port'

Advanced integration configuration

For advanced configuration such as proxies or self-signed certificates, click here.

Ingesting Wiz objects

The Wiz integration uses a YAML configuration to describe the process of loading data into the developer portal.

Here is an example snippet from the config which demonstrates the process for getting project data from Wiz:

createMissingRelatedEntities: true
deleteDependentEntities: true
resources:
  - kind: project
    selector:
      query: 'true'
    port:
      entity:
        mappings:
          blueprint: '"wizProject"'
          identifier: .id
          title: .name
          properties:
            archived: .archived
            businessUnit: .businessUnit
            description: .description

The integration makes use of the JQ JSON processor to select, modify, concatenate, transform and perform other operations on existing fields and values from Wiz's API events.

Configuration structure

The integration configuration determines which resources will be queried from Wiz, and which entities and properties will be created in Port.

Supported resources

The following resources can be used to map data from Wiz, it is possible to reference any field that appears in the API responses linked below for the mapping configuration.

• Project
• Issue
• Control

• The root key of the integration configuration is the resources key:

  resources:
    - kind: project
      selector:
      ...

• The kind key is a specifier for a Wiz object:

    resources:
      - kind: project
        selector:
        ...

• The selector and the query keys allow you to filter which objects of the specified kind will be ingested into your software catalog:

  resources:
    - kind: project
      selector:
        query: "true" # JQ boolean expression. If evaluated to false - this object will be skipped.
      port:

• The port, entity and the mappings keys are used to map the Wiz object fields to Port entities. To create multiple mappings of the same kind, you can add another item in the resources array;

  resources:
    - kind: project
      selector:
        query: "true"
      port:
        entity:
          mappings: # Mappings between one Wiz object to a Port entity. Each value is a JQ query.
            identifier: .id
            title: .attributes.name
            blueprint: '"wizProject"'
            identifier: .id
            title: .name
            properties:
              archived: .archived
              businessUnit: .businessUnit
              description: .description
    - kind: project # In this instance project is mapped again with a different filter
      selector:
        query: '.name == "MyProjectName"'
      port:
        entity:
          mappings: ...
  Blueprint key

  Note the value of the blueprint key - if you want to use a hardcoded string, you need to encapsulate it in 2 sets of quotes, for example use a pair of single-quotes (') and then another pair of double-quotes (")

Ingest data into Port

To ingest Wiz objects using the integration configuration, you can follow the steps below:

1. Go to the DevPortal Builder page.
2. Select a blueprint you want to ingest using Wiz.
3. Choose the Ingest Data option from the menu.
4. Select Wiz under the Code quality & security providers category.
5. Modify the configuration according to your needs.
6. Click Resync.

Examples

Examples of blueprints and the relevant integration configurations:

Project

Project blueprint

{
  "identifier": "wizProject",
  "description": "This blueprint represents a wiz project",
  "title": "Wiz Project",
  "icon": "Box",
  "schema": {
    "properties": {
      "archived": {
        "type": "boolean",
        "title": "Archived?",
        "description": "Is the project archived?"
      },
      "businessUnit": {
        "type": "string",
        "title": "Business Unit",
        "description": "the business unit of the project"
      },
      "description": {
        "type": "string",
        "title": "Description",
        "description": "the project description"
      }
    },
    "required": []
  },
  "mirrorProperties": {},
  "calculationProperties": {},
  "relations": {
    "issues": {
      "target": "wizIssue",
      "title": "Issues",
      "description": "The issues affecting this project",
      "required": false,
      "many": true
    }
  }
}

Integration configuration

resources:
  - kind: project
    selector:
      query: 'true'
    port:
      entity:
        mappings:
          blueprint: '"wizProject"'
          identifier: .id
          title: .name
          properties:
            archived: .archived
            businessUnit: .businessUnit
            description: .description

Control

Control blueprint

{
  "identifier": "wizControl",
  "description": "This blueprint represents a wiz source rule",
  "title": "Wiz Control",
  "icon": "Flag",
  "schema": {
    "properties": {
      "controlDescription": {
        "type": "string",
        "title": "Control Description",
        "description": "the control description"
      },
      "resolutionRecommendation": {
        "type": "string",
        "title": "Control Recommendation",
        "description": "the control recommendation on resolving issues"
      }
    },
    "required": []
  },
  "mirrorProperties": {},
  "calculationProperties": {},
  "relations": {}
}

Integration configuration

createMissingRelatedEntities: true
deleteDependentEntities: true
resources:
  - kind: control
    selector:
      query: 'true'
    port:
      entity:
        mappings:
          blueprint: '"wizControl"'
          identifier: .id
          title: .name
          properties:
            controlDescription: .controlDescription
            resolutionRecommendation: .resolutionRecommendation

Issue

Issue blueprint

{
  "identifier": "wizIssue",
  "description": "This blueprint represents a wiz issue",
  "title": "Wiz Issue",
  "icon": "Alert",
  "schema": {
    "properties": {
      "url": {
        "type": "string",
        "title": "Issue URL",
        "format": "url",
        "description": "the link to the issue"
      },
      "status": {
        "title": "Status",
        "type": "string",
        "enum": [
          "OPEN",
          "IN_PROGRESS",
          "RESOLVED",
          "REJECTED"
        ],
        "enumColors": {
          "OPEN": "blue",
          "IN_PROGRESS": "orange",
          "RESOLVED": "green",
          "REJECTED": "darkGray"
        }
      },
      "severity": {
        "title": "Severity",
        "type": "string",
        "enum": [
          "INFORMATIONAL",
          "LOW",
          "MEDIUM",
          "HIGH",
          "CRITICAL"
        ],
        "enumColors": {
          "INFORMATIONAL": "blue",
          "LOW": "yellow",
          "MEDIUM": "orange",
          "HIGH": "red",
          "CRITICAL": "red"
        }
      },
      "vulnerabilityType": {
        "title": "Vulnerability Type",
        "type": "string"
      },
      "wizIssueID": {
        "title": "Wiz Issue ID",
        "type": "string"
      },
      "cloudResourceType": {
        "title": "Cloud Resource Type",
        "type": "string"
      },
      "resourceName": {
        "title": "Resource Name",
        "type": "string"
      },
      "cloudPlatform": {
        "title": "Cloud Platform",
        "type": "string"
      },
      "linkToResource": {
        "title": "Link to Cloud Resource",
        "type": "string",
        "format": "url"
      },
      "cloudResourceID": {
        "title": "Cloud Resource ID",
        "type": "string"
      },
      "cloudRegion": {
        "title": "Cloud Region",
        "type": "string"
      },
      "resourceGroupExternalId": {
        "title": "Resource Group External ID",
        "type": "string"
      },
      "subscriptionExternalId": {
        "title": "Subscription External ID",
        "type": "string"
      },
      "subscriptionName": {
        "title": "Subscription Name",
        "type": "string"
      },
      "subscriptionTags": {
        "title": "Subscription Tags",
        "type": "object"
      },
      "resourceTags": {
        "title": "Resource Tags",
        "type": "object"
      },
      "vulnerability": {
        "title": "Vulnerability",
        "type": "object",
        "description": "The identified security risk"
      },
      "notes": {
        "title": "Notes",
        "type": "array"
      },
      "createdAt": {
        "title": "Created At",
        "type": "string",
        "format": "date-time"
      },
      "updatedAt": {
        "title": "Updated At",
        "type": "string",
        "format": "date-time"
      },
      "dueAt": {
        "title": "Due At",
        "type": "string",
        "format": "date-time"
      },
      "resolvedAt": {
        "title": "Resolved At",
        "type": "string",
        "format": "date-time"
      },
      "statusChangedAt": {
        "title": "Status ChangedAt",
        "type": "string",
        "format": "date-time"
      }
    },
    "required": []
  },
  "mirrorProperties": {},
  "calculationProperties": {},
  "relations": {
    "projects": {
      "target": "wizProject",
      "title": "Affected Projects",
      "description": "The projects affected by this issue",
      "required": false,
      "many": true
    },
    "serviceTickets": {
      "target": "wizServiceTicket",
      "title": "Service Tickets",
      "description": "The service tickets belonging to this issue",
      "required": false,
      "many": true
    },
    "control": {
      "target": "wizControl",
      "title": "Control",
      "description": "The control that flagged this issue",
      "required": false,
      "many": false
    }
  }
}

Integration configuration

createMissingRelatedEntities: true
deleteDependentEntities: true
resources:
  - kind: issue
    selector:
      query: 'true'
    port:
      entity:
        mappings:
          blueprint: '"wizIssue"'
          identifier: .id
          title: .entitySnapshot.name + " | " + .entitySnapshot.type
          properties:
            url: .id as $id | "https://app.wiz.io/issues#~(issue~'" + $id + ")"
            status: .status
            severity: .severity
            vulnerabilityType: .type
            notes: .notes
            wizIssueID: .entitySnapshot.id
            cloudResourceType: .entitySnapshot.type
            resourceName: .entitySnapshot.name
            cloudPlatform: .entitySnapshot.cloudPlatform
            linkToResource: if .entitySnapshot.cloudProviderURL == "" then null else .entitySnapshot.cloudProviderURL end
            cloudResourceID: .entitySnapshot.providerId
            cloudRegion: .entitySnapshot.region
            resourceGroupExternalId: .entitySnapshot.resourceGroupExternalId
            subscriptionExternalId: .entitySnapshot.subscriptionExternalId
            subscriptionName: .entitySnapshot.subscriptionName
            subscriptionTags: .entitySnapshot.subscriptionTags
            resourceTags: .entitySnapshot.tags
            vulnerability: .entitySnapshot
            createdAt: .createdAt
            updatedAt: .updatedAt
            statusChangedAt: .statusChangedAt
            resolvedAt: .resolvedAt
          relations:
            projects: .projects[].id
            serviceTickets: .serviceTickets[].externalId
            control: .sourceRule.id

Service Ticket

Service Ticket blueprint

{
  "identifier": "wizServiceTicket",
  "description": "This blueprint represents a wiz service ticket",
  "title": "Wiz Service Ticket",
  "icon": "Book",
  "schema": {
    "properties": {
      "url": {
        "type": "string",
        "title": "Ticket URL",
        "format": "url",
        "description": "the service ticket URL"
      }
    },
    "required": []
  },
  "mirrorProperties": {},
  "calculationProperties": {},
  "relations": {}
}

Integration configuration

createMissingRelatedEntities: true
deleteDependentEntities: true
resources:
  - kind: serviceTicket
  selector:
    query: 'true'
  port:
    entity:
      mappings:
        blueprint: '"wizServiceTicket"'
        identifier: .externalId
        title: .name
        properties:
          url: .url

Alternative installation via webhook

While the Ocean integration described above is the recommended installation method, you may prefer to use a webhook to ingest data from Wiz. If so, use the following instructions:

Webhook installation (click to expand)

In this example you are going to create a webhook integration between Wiz and Port, which will ingest Wiz issue entities into Port.

Port configuration

Create the following blueprint definition:

Wiz issue blueprint

{
  "identifier": "wizIssue",
  "description": "This blueprint represents a wiz issue",
  "title": "Wiz Issue",
  "icon": "Alert",
  "schema": {
    "properties": {
      "status": {
        "title": "Status",
        "type": "string",
        "enum": [
          "OPEN",
          "IN_PROGRESS",
          "RESOLVED",
          "REJECTED"
        ],
        "enumColors": {
          "OPEN": "blue",
          "IN_PROGRESS": "orange",
          "RESOLVED": "green",
          "REJECTED": "darkGray"
        }
      },
      "severity": {
        "title": "Severity",
        "type": "string",
        "enum": [
          "INFORMATIONAL",
          "LOW",
          "MEDIUM",
          "HIGH",
          "CRITICAL"
        ],
        "enumColors": {
          "INFORMATIONAL": "blue",
          "LOW": "yellow",
          "MEDIUM": "orange",
          "HIGH": "red",
          "CRITICAL": "red"
        }
      },
      "control": {
        "title": "Control",
        "type": "string",
        "description": "A security graph query defining a risk"
      },
      "vulnerability": {
        "title": "Vulnerability",
        "type": "object",
        "description": "The identified security risk"
      },
      "createdAt": {
        "title": "Created At",
        "type": "string",
        "format": "date-time"
      }
    },
    "required": []
  },
  "mirrorProperties": {},
  "calculationProperties": {},
  "relations": {}
}

Create the following webhook configuration using Port's UI

Wiz issue webhook configuration

1. Basic details tab - fill the following details:

   1. Title : Wiz Mapper;
   2. Identifier : wiz_mapper;
   3. Description : A webhook configuration to map Wiz issues to Port;
   4. Icon : Box;

2. Integration configuration tab - fill the following JQ mapping:

   [
     {
       "blueprint": "wizIssue",
       "entity": {
         "identifier": ".body.issue.id",
         "title": ".body.resource.name",
         "properties": {
           "status": ".body.issue.status",
           "severity": ".body.issue.severity",
           "control": ".body.control.name",
           "vulnerability": ".body.resource",
           "createdAt": ".body.issue.created"
         }
       }
     }
   ]

Create a webhook in Wiz

1. Send an email to win@wiz.io requesting for access to the developer documentation or reach out to your Wiz account manager.
2. Follow this guide in the documentation to create a webhook.

Done! Any issue created in Wiz will trigger a webhook event to the webhook URL provided by Port. Port will parse the events according to the mapping and update the catalog entities accordingly.