Wiz Backfill Integrations

Prior to v1.1, the Wiz Backfill integrations import and process details for your Assets IDs that are flagged as missing by the primary vulnerability integrations. Starting with v1.1, the backfill integrations are deprecated.

Upgrading to version 1.1

Starting with v1.1, the Missing Assets [sn_vul_wiz_missing_asset] table for storing assets from the backfill integrations is deprecated. After upgrading to version 1.1, you must backdate your primary Wiz integrations by three days and run them.

The Wiz Backfill Integrations are activated by default.

After you upgrade, the following backfill integrations are no longer required. The primary integrations can create discovered item records if they are not found.

• Host Vulnerability Backfill Integration
• Test Results Backfill Integration
• Host Test Results Backfill Integration
• Issues Backfill Integration

Backfill Integrations overview (for versions prior to v1.1)

A backfill integration is a specialized Wiz integration that processes asset IDs that are reported as missing by the primary Wiz integration imports. Asset IDs flagged as missing, that is, their discovered item records are not found, are stored on the Wiz Missing Assets [sn_vul_wiz_missing_asset] table.

The following Wiz Backfill integrations are activated automatically after their corresponding primary Wiz vulnerability integrations are successfully completed. These integrations process the missing Asset IDs based on their integration type that are stored on the Missing Assets table.

Primary integration	Backfill integration	Integration type
Host Vulnerability Integration	Host Vulnerability Backfill Integration	host_vr
Test Results Integration	Test Results Backfill Integration	test_results
Host Test Results Integration	Host Test Results Backfill Integration	host_test_results
Issues Integration	Issues Backfill Integration	issues

Remarque :

The Wiz Asset Integration does not have a backfill integration, because it can discover assets and create and update discovered item records on the Discovered item [sn_sec_cmn_src_ci] table. The Wiz Container Vulnerability Integration imports and processes discovered container image records.

For example, the Wiz Host Vulnerability Backfill Integration is activated automatically after the Wiz Host Vulnerability Integration is successfully completed. The backfill integration imports and processes any Asset IDs (type host_vr) that are not found by the Host Vulnerability Integration.

If discovered items are found for these Asset IDs by the backfill integration, they are reconciled with their corresponding records and processed. If a corresponding discovered item record is not found, the backfill integration skips these assets, and they remain stored on the Missing Assets table. After records on the Wiz Missing Assets table are successfully reconciled with discovered item records, they are removed from the Missing Assets table.

The backfill integrations by default import and process 100 records on the Wiz Missing Assets table for their corresponding primary Wiz vulnerability integrations. If more than 100 records are found by a backfill integration, an additional integration run for the backfill integration is automatically initiated to process the remaining records.

For example, if the Test Results Integration runs and reports 120 missing Asset IDs, these are stored on the Wiz Missing Asset table. The Test Results Backfill integration is automatically activated to process 100 records for type, test_results. After this Test Results Backfill Integration run is completed, an additional run for the Test Results Backfill Integration is automatically activated to process the remaining 20 records.

Schedule and activate the integrations on-demand

See Schedule the Wiz Vulnerability Integrations for more information about activating the integrations on-demand and scheduling integration runs.