Identify Wiz Resource types for the Wiz Vulnerability Integrations

Set filtering on the Wiz integration configuration page so that you import only the Resource Types (assets) reported by Wiz that you want.

시작하기 전에

Role required: sn_vul_wiz.configure_integration

프로시저

1. Navigate to All > Wiz Vulnerability Integration > Administration > Configuration.
2. Select the Resource Type Configuration tab and select the Unlock Resource types icon ().
3. With the Resource types field displayed, select the Add/Remove multiple icon () the third icon from the top to the right of the Resources types field.
   The Edit Members modal is displayed.
4. Select one or more resources from the Available Wiz Resource Types field and select the right arrow () to move them to the Selected Wiz Resource Types field.
   주:

   The resource types you configure on the configuration tab apply to all the Wiz integrations except the Wiz Container Vulnerability Integration. The Wiz Container Vulnerability Integration works with discovered container image records, not discovered item records.

   At a minimum, you must add either the VIRTUAL_MACHINE or SERVERLESS resource type for the Host Vulnerability Integration. You can add both. For the Host Test Results Integration, you must, at a minimum, add the VIRTUAL_MACHINE resource type.

5. Select Save.
   The Resource Type Configuration tab is displayed. Your saved resources are displayed on the tab.
6. Select the lock Resource types icon ().
7. Select Save to save your edits.
8. Select Save and test if you’re ready to validate your credentials.

   If your credentials are successfully saved and validated, a message is displayed.

   After you validate and test, you have the option to set more filtering parameters on the integration instance records. With this filtering, you can further limit imports to only the specific resource types that you want to import for the Host Vulnerability and Test Results integrations.

   주:

   If you configure resource types on the Resource Type Configuration tab, and you choose to configure parameters on the integration instance records, your configurations on integration instance take precedence over your settings on the Resource Type Configuration tab.

   For example, if you add VIRTUAL_MACHINE on the Resource Type Configuration Tab, and you also configure SERVERLESS for the Host Vulnerability integration instance, the Host Vulnerability integration will import only the SERVERLESS Resource Type.

   If you add VIRTUAL_MACHINE and SERVERLESS resource types on the Resource Type Configuration Tab, and you also configure SERVERLESS for the Host Vulnerability integration instance, the Host Vulnerability integration will import only the SERVERLESS Resource Type.

9. 옵션: To add more filter parameters, follow these steps on the integration instance records.
   1. To navigate to the Integration Instance [sn_sec_int_impl] table, enter sn_sec_int_impl.LIST in the navigation panel.
   2. Select the Vulnerability Response Integration with Wiz record to open it.
   3. On the Integration Instance Parameters tab, enter one of the following parameters into the Search field under the Configuration column.
      • host_asset_type
      • cc_resource_type
   4. Select the information icon () next to the record link to open the record.
      주:

      You might have to select the link to change the scope for the record.
      The Integration Parameter record is displayed.
   5. Enter the resources that you want to import in the Default value field for the respective integration.

      You can enter values only for the Host Vulnerability and Test Results Integrations. These values must also be on the Resource Type Configuration tab that you entered in the previous steps.

      For example, for the Host Integration, enter any values in the host_asset_type field that you entered on the Resource Type Configuration tab for this integration.

      For the Test Results Integration, enter any values in the cc_resource_type field that you entered on the Resource Type Configuration tab for this integration.

   6. Select Update to save your changes.
      The Integration Instance record is displayed.

      You have the option to limit the number of assets you import with each integration run for the Wiz Asset Integration.

10. 옵션: To modify the number of records processed per Integration Process for the Asset Integration, follow these steps.
    1. Navigate to All > Wiz Vulnerability Integration > Admin > Integrations.
    2. Select the Wiz Asset Integration record to open it.
       This integration is activated by default. The default setting for imported records is 500.
    3. Select the information icon next to the Source Instance field to open the integration instance record.
    4. In the Search field with the Integration Instance Parameters tab selected, enter the asset_record_count parameter.
    5. Select the record in the Configuration column to open it.
    6. Verify that you are in the proper scope to edit the record.
    7. Double-click the Value field to modify it.
    8. Select Update to save your changes.

다음에 수행할 작업

After you configure all of the integrations, schedule the Wiz Asset Integration or initiate it on-demand so it runs before the other integrations. This is the only integration that can discover, import, and create discovered item records for Wiz data. The other integrations depend on imported data from the Wiz Asset Integration. The Wiz Container Vulnerability Integration imports and processes discovered container image records.

See schedule Wiz integrations for more information about scheduling and activating the Wiz integrations and backfill integrations on-demand.

To set filtering for the integrations, for more information see:

• Set filtering for the Wiz Host Vulnerabilities Integration
• Set filtering for the Wiz Container Vulnerabilities Integration
• Set filtering for the Wiz Test Results Integration
• Set filtering for the Wiz Test Results Integration
• Set filtering for the Wiz Issues Integration
• Set filtering for the Wiz Host Test Results Integration