Skip to main content
Last updated on

Ingest data from Wiz Audit Logs

Beta

This feature is in Beta. Workspace admins can control access to this feature from the Previews page. See Manage Databricks previews.

This page shows how to create a managed Wiz Audit Logs ingestion pipeline using Lakeflow Connect.

Requirements​

  • To create an ingestion pipeline, you must first meet the following requirements:

    • Your workspace must be enabled for Unity Catalog.

    • Serverless compute must be enabled for your workspace. See Serverless compute requirements.

    • If you plan to create a new connection: You must have CREATE CONNECTION privileges on the metastore. See Manage privileges in Unity Catalog.

      If the connector supports UI-based pipeline authoring, an admin can create the connection and the pipeline at the same time by completing the steps on this page. However, if the users who create pipelines use API-based pipeline authoring or are non-admin users, an admin must first create the connection in Catalog Explorer. See Connect to managed ingestion sources.

    • If you plan to use an existing connection: You must have USE CONNECTION privileges or ALL PRIVILEGES on the connection object.

    • You must have USE CATALOG privileges on the target catalog.

    • You must have USE SCHEMA and CREATE TABLE privileges on an existing schema or CREATE SCHEMA privileges on the target catalog.

  • To ingest from Wiz, you must first configure authentication from Databricks and create a connection. See Configure authentication to Wiz and Create a Wiz Audit Logs connection.

Create an ingestion pipeline​

For the list of supported source tables, see Supported source tables.

  1. In the sidebar of the Databricks workspace, click Data Ingestion.
  2. On the Add data page, under Databricks connectors, click Wiz Audit Logs.
  3. On the Connection page of the ingestion wizard, select the connection that stores your Wiz credentials. If you have the CREATE CONNECTION privilege on the metastore, you can click Plus icon. Create connection to create a connection with the credentials from Configure authentication to Wiz.
  4. Click Next.
  5. On the Ingestion setup page, enter a name for the pipeline.
  6. Select a catalog and a schema to write data to. If you have USE CATALOG and CREATE SCHEMA privileges on the catalog, you can click Plus icon. Create schema in the drop-down menu to create a schema.
  7. Click Create pipeline and continue.
  8. On the Source page, select the tables to ingest.
  9. Click Save and continue.
  10. On the Destination page, select a catalog and a schema to load data into. If you have USE CATALOG and CREATE SCHEMA privileges on the catalog, you can click Plus icon. Create schema in the drop-down menu to create a schema.
  11. Click Save and continue.
  12. (Optional) On the Schedules and notifications page, click Plus icon. Create schedule. Set the frequency to refresh the destination tables.
  13. (Optional) Click Plus icon. Add notification to set email notifications for pipeline operation success or failure.
  14. Click Save and run pipeline.

Examples​

The Wiz Audit Logs connector makes available audit log, issue, and vulnerability finding tables in the default source schema. For the full list, see Supported source tables. Ingest individual tables or the entire schema.

Ingest specific tables​

Use this option to ingest a specific subset of tables, or to customize destination naming per table.

YAML
resources:
  pipelines:
    wiz_audit_logs_pipeline:
      name: wiz_audit_logs_pipeline
      catalog: 'main'
      target: 'wiz_audit_logs_data'
      ingestion_definition:
        connection_name: wiz_audit_logs_connection
        objects:
          - table:
              source_schema: 'default'
              source_table: 'audit_log_entries'
              destination_catalog: 'main'
              destination_schema: 'wiz_audit_logs_data'
              destination_table: 'audit_log_entries'
          - table:
              source_schema: 'default'
              source_table: 'vulnerability_findings'
              destination_catalog: 'main'
              destination_schema: 'wiz_audit_logs_data'
              destination_table: 'vulnerability_findings'

Ingest the entire schema​

Use this option to ingest all Wiz Audit Logs source tables into a single destination schema with one declaration.

YAML
resources:
  pipelines:
    wiz_audit_logs_pipeline:
      name: wiz_audit_logs_pipeline
      catalog: 'main'
      target: 'wiz_audit_logs_data'
      ingestion_definition:
        connection_name: wiz_audit_logs_connection
        objects:
          - schema:
              source_schema: 'default'
              destination_catalog: 'main'
              destination_schema: 'wiz_audit_logs_data'

Declarative Automation Bundles job definition file​

The following is an example job definition file for use with Declarative Automation Bundles. The job runs daily.

YAML
resources:
  jobs:
    wiz_audit_logs_job:
      name: wiz_audit_logs_job
      schedule:
        quartz_cron_expression: '0 0 0 * * ?'
        timezone_id: 'UTC'
      tasks:
        - task_key: wiz_audit_logs_ingestion
          pipeline_task:
            pipeline_id: ${resources.pipelines.wiz_audit_logs_pipeline.id}

Common patterns​

For advanced pipeline configurations, see Common patterns for managed ingestion pipelines.

Next steps​

Start, schedule, and set alerts on your pipeline. See Common pipeline maintenance tasks.

Additional resources​

On this page