Wiz

Preview

Lakewatch is in Private Preview. To request access, reach out to your Databricks account team.

Lakewatch provides an API connector to ingest audit log entries, issues, and vulnerability findings from Wiz. This article covers prerequisites, configuration instructions, connector schemas, and Lakewatch parser observables.

Prerequisites

The connector requires:

1. Serverless Lakeflow Spark Declarative Pipelines turned on in your workspace.
2. Unity Catalog, with privileges to create or use a Unity Catalog connection. See Connection permissions.
3. A Wiz tenant with administrator access to create a service account.
4. Permission to grant the service account read access to the audit logs, issues, and vulnerability findings you want to ingest.

Known limitations

• SCD type 2 is not supported because Wiz security data is ingested as an append-only feed.
• The connector supports OAuth machine-to-machine (M2M) authentication with a Wiz service account. API token and basic authentication aren't supported.
• Automated schema evolution supports new and deleted columns, but not data type changes or column renames.
• Historical lookback can't exceed 180 days. See Choose how far back to ingest.

Configure Wiz for ingestion

In this step, you create a service account in Wiz and note the credentials that you use to create a connection in Databricks.

1. Sign in to your Wiz tenant as an administrator.
2. Create a service account for the connector:
   1. In the Wiz portal, go to Settings > Access Management > Service Accounts, then click Add Service Account.
   2. Enter a descriptive Name for the service account.
   3. For Type, select Custom Integration (GraphQL API).
   4. Grant the service account the API scopes for the data you want to ingest:
      • read:resources (required for all ingestion)
      • admin:audit to ingest audit log entries
      • read:issues to ingest issues
      • read:vulnerabilities to ingest vulnerability findings
   5. Leave Projects blank. Selecting one or more projects prevents the service account from querying audit logs, because the admin:audit scope is available only when no project is selected.
   6. Create the service account.
3. Note the service account's Client ID and Client Secret. Copy the client secret immediately, because Wiz does not display it again after you close the dialog. You enter these values when you create a connection in Databricks.
4. Get your tenant details. Click your profile icon in the top right of the Wiz portal, then click Tenant Info. Note the following values, which you enter when you create a connection in Databricks:
   • On the General tab, the Authentication URL. This is the token endpoint that the connector uses to exchange the client credentials for an access token. For example, https://auth.app.wiz.io/oauth/token.
   • On the Data Center and Regions tab, your data center. This is your Tenant Data Center.

tip

When you create a connection through the Lakewatch UI, enter the Tenant Data Center, Client ID, Client Secret, and Authentication URL gathered above.

For more information, see Configure authentication to Wiz.

Next steps

After completing the configuration above, create a datasource with the Wiz connector in the Lakewatch UI. See API connectors for instructions.

---

Connector and Lakewatch schemas

The connector ingests the following source tables from the default source schema:

Source table	Wiz data	Built-in Lakewatch parser
audit_log_entries	User actions, service account activity, and configuration changes	wiz_audit
issues	Risks detected in the cloud environment, including status and severity	wiz_issues
vulnerability_findings	Vulnerabilities, affected assets, severity, and remediation guidance	wiz_vulnerability_finding

Source table	Wiz data	Built-in Lakewatch parser
audit_log_entries	User actions, service account activity, and configuration changes	wiz_audit
issues	Risks detected in the cloud environment, including status and severity	wiz_issues
vulnerability_findings	Vulnerabilities, affected assets, severity, and remediation guidance	wiz_vulnerability_finding

The connector writes each source table to the datasource's raw destination. Each built-in parser writes a separate parsed table named after the parser, unless you set a parsed destination when you configure the datasource.

Lakewatch-managed columns

The connector adds the following columns to each raw source row:

• lw_id: A non-null string that Lakewatch uses as the primary key. The connector derives a stable, time-sortable ID from time and the Wiz id field.
• time: A timestamp used for incremental ingestion. For audit_log_entries, the connector derives time from timestamp. For issues, it derives time from createdAt. For vulnerability_findings, it derives time from updatedAt.

The wiz_issues parser sets the parsed time field from updatedAt, so the parsed table reflects the most recent issue update time.

Each parsed table carries lw_id forward and adds:

• lw_meta: Standard Lakewatch processing metadata.
• lw_observables: Values extracted from fields marked as security observables in the parser.

For more information, see Parser reference.

Raw connector table schemas

The following schemas include the Wiz fields and the Lakewatch-managed lw_id and time columns. For field definitions, see the Wiz connector reference.

audit_log_entries

Schema

Column	Data type
lw_id	STRING
time	TIMESTAMP
id	STRING
action	STRING
requestId	STRING
status	STRING
timestamp	TIMESTAMP
actionParameters	STRING
userAgent	STRING
sourceIP	STRING
serviceAccount	STRUCT<id: STRING, name: STRING>
user	STRUCT<id: STRING, name: STRING>

Column	Data type
lw_id	STRING
time	TIMESTAMP
id	STRING
action	STRING
requestId	STRING
status	STRING
timestamp	TIMESTAMP
actionParameters	STRING
userAgent	STRING
sourceIP	STRING
serviceAccount	STRUCT<id: STRING, name: STRING>
user	STRUCT<id: STRING, name: STRING>

issues

Schema

Column	Data type
lw_id	STRING
time	TIMESTAMP
id	STRING
sourceRule	STRING
createdAt	TIMESTAMP
updatedAt	TIMESTAMP
dueAt	TIMESTAMP
type	STRING
resolvedAt	TIMESTAMP
statusChangedAt	TIMESTAMP
projects	ARRAY<STRUCT<id: STRING, name: STRING, slug: STRING, businessUnit: STRING, riskProfile: STRING>>
status	STRING
severity	STRING
entitySnapshot	STRING
serviceTickets	STRING
notes	STRING

Column	Data type
lw_id	STRING
time	TIMESTAMP
id	STRING
sourceRule	STRING
createdAt	TIMESTAMP
updatedAt	TIMESTAMP
dueAt	TIMESTAMP
type	STRING
resolvedAt	TIMESTAMP
statusChangedAt	TIMESTAMP
projects	ARRAY<STRUCT<id: STRING, name: STRING, slug: STRING, businessUnit: STRING, riskProfile: STRING>>
status	STRING
severity	STRING
entitySnapshot	STRING
serviceTickets	STRING
notes	STRING

vulnerability_findings

Schema

Column	Data type
lw_id	STRING
time	TIMESTAMP
id	STRING
portalUrl	STRING
name	STRING
CVEDescription	STRING
CVSSSeverity	STRING
score	DOUBLE
exploitabilityScore	DOUBLE
impactScore	DOUBLE
dataSourceName	STRING
hasExploit	BOOLEAN
hasCisaKevExploit	BOOLEAN
status	STRING
vendorSeverity	STRING
firstDetectedAt	TIMESTAMP
lastDetectedAt	TIMESTAMP
updatedAt	TIMESTAMP
resolvedAt	TIMESTAMP
description	STRING
remediation	STRING
detailedName	STRING
version	STRING
fixedVersion	STRING
detectionMethod	STRING
link	STRING
locationPath	STRING
resolutionReason	STRING
epssSeverity	STRING
epssPercentile	DOUBLE
epssProbability	DOUBLE
validatedInRuntime	STRING
layerMetadata	STRING
projects	ARRAY<STRUCT<id: STRING, name: STRING, slug: STRING, businessUnit: STRING>>
ignoreRules	ARRAY<STRUCT<id: STRING, name: STRING, enabled: BOOLEAN>>
vulnerableAsset	STRING

Column	Data type
lw_id	STRING
time	TIMESTAMP
id	STRING
portalUrl	STRING
name	STRING
CVEDescription	STRING
CVSSSeverity	STRING
score	DOUBLE
exploitabilityScore	DOUBLE
impactScore	DOUBLE
dataSourceName	STRING
hasExploit	BOOLEAN
hasCisaKevExploit	BOOLEAN
status	STRING
vendorSeverity	STRING
firstDetectedAt	TIMESTAMP
lastDetectedAt	TIMESTAMP
updatedAt	TIMESTAMP
resolvedAt	TIMESTAMP
description	STRING
remediation	STRING
detailedName	STRING
version	STRING
fixedVersion	STRING
detectionMethod	STRING
link	STRING
locationPath	STRING
resolutionReason	STRING
epssSeverity	STRING
epssPercentile	DOUBLE
epssProbability	DOUBLE
validatedInRuntime	STRING
layerMetadata	STRING
projects	ARRAY<STRUCT<id: STRING, name: STRING, slug: STRING, businessUnit: STRING>>
ignoreRules	ARRAY<STRUCT<id: STRING, name: STRING, enabled: BOOLEAN>>
vulnerableAsset	STRING

Parser observables

The built-in parsers write nested objects as VARIANT and extract the following fields into lw_observables.

wiz_audit

Observables

Field	Observable
sourceIP	ip
serviceAccount.id	actor_id
user.id	actor_id
user.name	username

Field	Observable
sourceIP	ip
serviceAccount.id	actor_id
user.id	actor_id
user.name	username

The wiz_issues parser doesn't define any observable fields.

wiz_vulnerability_finding

Observables

Field	Observable
portalUrl	url
link	url

Field	Observable
portalUrl	url
link	url