From 1a0b1fa1b852e263e1caeb1c2acae50e1c40ee66 Mon Sep 17 00:00:00 2001 From: vg-svitla Date: Sat, 25 Jan 2025 16:00:52 +0400 Subject: [PATCH 1/4] Feature: Wiz Issues integration --- .../categories/network_security/wiz.md | 42 +++++++++++++++++++ mkdocs.yml | 1 + 2 files changed, 43 insertions(+) create mode 100644 docs/integration/categories/network_security/wiz.md diff --git a/docs/integration/categories/network_security/wiz.md b/docs/integration/categories/network_security/wiz.md new file mode 100644 index 000000000..ec257ae58 --- /dev/null +++ b/docs/integration/categories/network_security/wiz.md @@ -0,0 +1,42 @@ +--- +uuid: de3bfaa0-8ed4-4b5a-b3fa-bd82b7744a9a +name: Wiz +type: intake +--- + +## Overview + +!!! Warning + Important note - This format is currently in beta. We highly value your feedback to improve its performance. + +- **Supported environment**: On Premise / SaaS +- **Detection based on**: Telemetry, Alerts, Audit +- **Supported application or feature**: + - Issues + +## Configure + +### Pre-requisite + +To setup the integration, you need to have access to `Wiz Console`. + +### Create Client ID and Client Secret + +- Log in the Wiz console +- Go to `Settings` > `Service Accounts` +- Type a name for the new service account. e.g: [Sekoia.io](http://Sekoia.io) Integration +- Select `read:issues` permission +- Click `Add Service Account` +- Copy the Client ID and the Client Secret + +### Create the intake + +Go to the [intake page](https://app.sekoia.io/operations/intakes) and create a new intake from the format **Wiz Issues**. + +{!_shared_content/operations_center/integrations/generated/de3bfaa0-8ed4-4b5a-b3fa-bd82b7744a9a.md!} + +{!_shared_content/integration/detection_section.md!} + +{!_shared_content/operations_center/detection/generated/suggested_rules_de3bfaa0-8ed4-4b5a-b3fa-bd82b7744a9a_do_not_edit_manually.md!} + +{!_shared_content/operations_center/integrations/generated/de3bfaa0-8ed4-4b5a-b3fa-bd82b7744a9a.md!} diff --git a/mkdocs.yml b/mkdocs.yml index c4811a1df..bc40cd7a1 100644 --- a/mkdocs.yml +++ b/mkdocs.yml @@ -491,6 +491,7 @@ nav: - Varonis Data Security: integration/categories/network_security/varonis_data_security.md - Vectra Cognito Detect: integration/categories/network_security/vectra.md - WatchGuard Firebox: integration/categories/network_security/watchguard_firebox.md + - Wiz: integration/categories/network_security/wiz.md - Zscaler Internet Access: integration/categories/network_security/zscaler_zia.md - List of Playbooks Actions: - Applicative: From 123374c81473ff23fa539b9d729053d80bc8e5f1 Mon Sep 17 00:00:00 2001 From: Sebastien Quioc Date: Thu, 13 Feb 2025 11:27:08 +0100 Subject: [PATCH 2/4] fix(Wiz): apply some fixes on the documentation --- .../network_security/{wiz.md => wiz_issues.md} | 14 +++++++------- mkdocs.yml | 2 +- 2 files changed, 8 insertions(+), 8 deletions(-) rename docs/integration/categories/network_security/{wiz.md => wiz_issues.md} (88%) diff --git a/docs/integration/categories/network_security/wiz.md b/docs/integration/categories/network_security/wiz_issues.md similarity index 88% rename from docs/integration/categories/network_security/wiz.md rename to docs/integration/categories/network_security/wiz_issues.md index ec257ae58..905a41b00 100644 --- a/docs/integration/categories/network_security/wiz.md +++ b/docs/integration/categories/network_security/wiz_issues.md @@ -1,19 +1,19 @@ --- uuid: de3bfaa0-8ed4-4b5a-b3fa-bd82b7744a9a -name: Wiz +name: Wiz Issues type: intake --- ## Overview -!!! Warning - Important note - This format is currently in beta. We highly value your feedback to improve its performance. - -- **Supported environment**: On Premise / SaaS -- **Detection based on**: Telemetry, Alerts, Audit +- **Supported environment**: SaaS +- **Detection based on**: Alerts - **Supported application or feature**: - Issues +!!! Warning + Important note - This format is currently in beta. We highly value your feedback to improve its performance. + ## Configure ### Pre-requisite @@ -33,7 +33,7 @@ To setup the integration, you need to have access to `Wiz Console`. Go to the [intake page](https://app.sekoia.io/operations/intakes) and create a new intake from the format **Wiz Issues**. -{!_shared_content/operations_center/integrations/generated/de3bfaa0-8ed4-4b5a-b3fa-bd82b7744a9a.md!} +{!_shared_content/operations_center/integrations/generated/de3bfaa0-8ed4-4b5a-b3fa-bd82b7744a9a_sample.md!} {!_shared_content/integration/detection_section.md!} diff --git a/mkdocs.yml b/mkdocs.yml index 33de27162..0313e93de 100644 --- a/mkdocs.yml +++ b/mkdocs.yml @@ -497,7 +497,7 @@ nav: - Varonis Data Security: integration/categories/network_security/varonis_data_security.md - Vectra Cognito Detect: integration/categories/network_security/vectra.md - WatchGuard Firebox: integration/categories/network_security/watchguard_firebox.md - - Wiz: integration/categories/network_security/wiz.md + - Wiz Issues: integration/categories/network_security/wiz_issues.md - Zscaler Internet Access: integration/categories/network_security/zscaler_zia.md - List of Playbooks Actions: - Overview: integration/action_library/overview.md From 36b29c1cc724bc59a12a27cfabb18d946d318c35 Mon Sep 17 00:00:00 2001 From: Sebastien Quioc Date: Thu, 13 Feb 2025 11:36:24 +0100 Subject: [PATCH 3/4] feat(Wiz): add documentation for Wiz cloud configuration findings --- .../wiz_cloud_configuration_findings.md | 42 +++++++++++++++++++ mkdocs.yml | 1 + 2 files changed, 43 insertions(+) create mode 100644 docs/integration/categories/network_security/wiz_cloud_configuration_findings.md diff --git a/docs/integration/categories/network_security/wiz_cloud_configuration_findings.md b/docs/integration/categories/network_security/wiz_cloud_configuration_findings.md new file mode 100644 index 000000000..957bfb194 --- /dev/null +++ b/docs/integration/categories/network_security/wiz_cloud_configuration_findings.md @@ -0,0 +1,42 @@ +--- +uuid: e54b4831-4d56-4270-962d-4943b16230d9 +name: Wiz Cloud Configuration Findings +type: intake +--- + +## Overview + +- **Supported environment**: SaaS +- **Detection based on**: Alerts +- **Supported application or feature**: + - Cloud Configuration Findings + +!!! Warning + Important note - This format is currently in beta. We highly value your feedback to improve its performance. + +## Configure + +### Pre-requisite + +To setup the integration, you need to have access to `Wiz Console`. + +### Create Client ID and Client Secret + +- Log in the Wiz console +- Go to `Settings` > `Service Accounts` +- Type a name for the new service account. e.g: [Sekoia.io](http://Sekoia.io) Integration +- Select `read:issues` permission +- Click `Add Service Account` +- Copy the Client ID and the Client Secret + +### Create the intake + +Go to the [intake page](https://app.sekoia.io/operations/intakes) and create a new intake from the format **Wiz Cloud Configuration Findings**. + +{!_shared_content/operations_center/integrations/generated/e54b4831-4d56-4270-962d-4943b16230d9_sample.md!} + +{!_shared_content/integration/detection_section.md!} + +{!_shared_content/operations_center/detection/generated/suggested_rules_e54b4831-4d56-4270-962d-4943b16230d9_do_not_edit_manually.md!} + +{!_shared_content/operations_center/integrations/generated/e54b4831-4d56-4270-962d-4943b16230d9.md!} diff --git a/mkdocs.yml b/mkdocs.yml index 0313e93de..a226f1ef8 100644 --- a/mkdocs.yml +++ b/mkdocs.yml @@ -497,6 +497,7 @@ nav: - Varonis Data Security: integration/categories/network_security/varonis_data_security.md - Vectra Cognito Detect: integration/categories/network_security/vectra.md - WatchGuard Firebox: integration/categories/network_security/watchguard_firebox.md + - Wiz Cloud configuration findings: integration/categories/network_security/wiz_cloud_configuration_findings.md - Wiz Issues: integration/categories/network_security/wiz_issues.md - Zscaler Internet Access: integration/categories/network_security/zscaler_zia.md - List of Playbooks Actions: From 8f038c95469ef6595e7f4996400b5c8cd7f78e56 Mon Sep 17 00:00:00 2001 From: Sebastien Quioc Date: Tue, 18 Feb 2025 10:30:10 +0100 Subject: [PATCH 4/4] fix(Wiz): fix permission --- .../network_security/wiz_cloud_configuration_findings.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/integration/categories/network_security/wiz_cloud_configuration_findings.md b/docs/integration/categories/network_security/wiz_cloud_configuration_findings.md index 957bfb194..26eeaf8bc 100644 --- a/docs/integration/categories/network_security/wiz_cloud_configuration_findings.md +++ b/docs/integration/categories/network_security/wiz_cloud_configuration_findings.md @@ -25,7 +25,7 @@ To setup the integration, you need to have access to `Wiz Console`. - Log in the Wiz console - Go to `Settings` > `Service Accounts` - Type a name for the new service account. e.g: [Sekoia.io](http://Sekoia.io) Integration -- Select `read:issues` permission +- Select `read:cloud_configuration` permission - Click `Add Service Account` - Copy the Client ID and the Client Secret