Wiz Backfill Integrations
Summarize
Summary of Wiz Backfill Integrations
The Wiz Backfill Integrations, prior to version 1.1, were designed to import and process asset IDs flagged as missing by primary vulnerability integrations. Starting with version 1.1, these integrations are deprecated, and the Missing Assets table is no longer used for storing backfilled assets.
Show less
Key Features
- The backfill integrations automatically process missing asset IDs after the primary integrations complete.
- Each primary integration has a corresponding backfill integration, which handles reconciliation of discovered items.
- For versions before 1.1, the integrations specifically address asset IDs not found in primary imports.
- Backfill integrations by default process 100 records at a time, triggering additional runs if more records are present.
Key Outcomes
After upgrading to version 1.1, it is crucial to backdate primary Wiz integrations by three days and execute them. Following this upgrade, the backfill integrations will no longer be necessary as primary integrations can directly create discovered item records for missing assets. This streamlines the process and enhances asset management efficiency.
Prior to v1.1, the Wiz Backfill integrations import and process details for your Assets IDs that are flagged as missing by the primary vulnerability integrations. Starting with v1.1, the backfill integrations are deprecated.
Upgrading to version 1.1
Starting with v1.1, the Missing Assets [sn_vul_wiz_missing_asset] table for storing assets from the backfill integrations is deprecated. After upgrading to version 1.1, you must backdate your primary Wiz integrations by three days and run them.
The Wiz Backfill Integrations are activated by default.
- Host Vulnerability Backfill Integration
- Test Results Backfill Integration
- Host Test Results Backfill Integration
- Issues Backfill Integration
Backfill Integrations overview (for versions prior to v1.1)
A backfill integration is a specialized Wiz integration that processes asset IDs that are reported as missing by the primary Wiz integration imports. Asset IDs flagged as missing, that is, their discovered item records are not found, are stored on the Wiz Missing Assets [sn_vul_wiz_missing_asset] table.
| Primary integration | Backfill integration | Integration type |
|---|---|---|
| Host Vulnerability Integration | Host Vulnerability Backfill Integration | host_vr |
| Test Results Integration | Test Results Backfill Integration | test_results |
| Host Test Results Integration | Host Test Results Backfill Integration | host_test_results |
| Issues Integration | Issues Backfill Integration | issues |
For example, the Wiz Host Vulnerability Backfill Integration is activated automatically after the Wiz Host Vulnerability Integration is successfully completed. The backfill integration imports and processes any Asset IDs (type host_vr) that are not found by the Host Vulnerability Integration.
If discovered items are found for these Asset IDs by the backfill integration, they are reconciled with their corresponding records and processed. If a corresponding discovered item record is not found, the backfill integration skips these assets, and they remain stored on the Missing Assets table. After records on the Wiz Missing Assets table are successfully reconciled with discovered item records, they are removed from the Missing Assets table.
The backfill integrations by default import and process 100 records on the Wiz Missing Assets table for their corresponding primary Wiz vulnerability integrations. If more than 100 records are found by a backfill integration, an additional integration run for the backfill integration is automatically initiated to process the remaining records.
For example, if the Test Results Integration runs and reports 120 missing Asset IDs, these are stored on the Wiz Missing Asset table. The Test Results Backfill integration is automatically activated to process 100 records for type, test_results. After this Test Results Backfill Integration run is completed, an additional run for the Test Results Backfill Integration is automatically activated to process the remaining 20 records.
Schedule and activate the integrations on-demand
See Schedule the Wiz Vulnerability Integrations for more information about activating the integrations on-demand and scheduling integration runs.