Troubleshoot the Wiz Audit Logs connector

Beta

This feature is in Beta. Workspace admins can control access to this feature from the Previews page. See Manage Databricks previews.

This page describes common errors you might encounter with the managed Wiz Audit Logs connector and how to resolve them.

Wiz authentication or authorization failed

Cause: Wiz returned an HTTP 401 or 403 response. This usually means one of the following: the service account's client ID or client secret is incorrect, the client secret was rotated, or the service account's permissions don't include read access to the data you're ingesting.

Solution:

1. Confirm that the Client ID and Client Secret in the Unity Catalog connection match a current Wiz service account.
2. If the client secret was rotated, update the connection with the new value, and run the pipeline again.
3. Confirm that the service account has read access to the audit log entries, issues, and vulnerability findings you ingest.
4. Confirm that the Authentication URL and Tenant Data Center in the connection match your Wiz tenant.

For details, see Configure authentication to Wiz.

Wiz API rate limit exceeded

Cause: Wiz returned an HTTP 429 response because the API request rate exceeded your tenant's limit.

Solution:

The connector automatically backs off and retries. If this happens repeatedly, reduce the pipeline's schedule frequency or the number of concurrent pipelines that share the same Wiz service account.

Wiz API temporarily unavailable

Cause: Wiz returned a transient server error (HTTP 500, 502, 503, or 504).

Solution:

The connector automatically retries. If the issue persists, wait, then run the pipeline again.

Error in the Wiz response

Error message:

GraphQL error in Wiz response body

Cause: Wiz returned a successful HTTP response that contains an error in the response body. This can happen when a requested field or filter isn't available for your tenant or plan.

Solution:

The connector retries the request. If the error persists, confirm that your Wiz tenant and plan support the tables you're ingesting, then run the pipeline again.