{
    "id": "Wiz",
    "title": "Wiz",
    "publisher": "Wiz",
    "descriptionMarkdown": "The Wiz connector allows you to easily send Wiz Issues, Vulnerability Findings, and Audit logs to Microsoft Sentinel.",
    "logo": "Wiz.svg",
    "graphQueries": [
        {
            "metricName": "Total data received",
            "legend": "WizIssues",
            "baseQuery": "union isfuzzy=true \n(WizIssues_CL),\n(WizIssuesV2_CL)"
        },
        {
            "metricName": "Total data received",
            "legend": "WizVulnerabilities",
            "baseQuery": "union isfuzzy=true \n(WizVulnerabilities_CL),\n(WizVulnerabilitiesV2_CL)"
        },
        {
            "metricName": "Total data received",
            "legend": "WizAuditLogs",
            "baseQuery": "union isfuzzy=true \n(WizAuditLogs_CL),\n(WizAuditLogsV2_CL)"
        }
    ],
    "sampleQueries": [
        {
            "description": "Summary by Issues's severity",
            "query": "union isfuzzy=true \n(WizIssues_CL),\n(WizIssuesV2_CL)\n       | summarize Count=count() by severity_s"
        }
    ],
    "connectivityCriterias": [
        {
            "type": "IsConnectedQuery",
            "value": [
                "union isfuzzy=true \n(WizIssues_CL),\n(WizIssuesV2_CL)\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(30d)",
                "union isfuzzy=true \n(WizVulnerabilities_CL),\n(WizVulnerabilitiesV2_CL)\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(30d)",
                "union isfuzzy=true \n(WizAuditLogs_CL),\n(WizAuditLogsV2_CL)\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(30d)"
            ]
        }
    ],
    "dataTypes": [
        {
            "name": "WizIssues",
            "lastDataReceivedQuery": "union isfuzzy=true \n(WizIssues_CL),\n(WizIssuesV2_CL)\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        },
        {
            "name": "WizVulnerabilities",
            "lastDataReceivedQuery": "union isfuzzy=true \n(WizVulnerabilities_CL),\n(WizVulnerabilitiesV2_CL)\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        },
        {
            "name": "WizAuditLogs",
            "lastDataReceivedQuery": "union isfuzzy=true \n(WizAuditLogs_CL),\n(WizAuditLogsV2_CL)\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        }
    ],
    "availability": {
        "status": 2,
        "isPreview": false
    },
    "permissions": {
        "resourceProvider": [
            {
                "provider": "Microsoft.OperationalInsights/workspaces",
                "permissionsDisplayText": "read and write permissions are required.",
                "providerDisplayName": "Workspace",
                "scope": "Workspace",
                "requiredPermissions": {
                    "write": true,
                    "read": true,
                    "delete": true
                }
            },
            {
                "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys",
                "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).",
                "providerDisplayName": "Keys",
                "scope": "Workspace",
                "requiredPermissions": {
                    "action": true
                }
            }
        ],
        "customs": [
            {
                "name": "Microsoft.Web/sites permissions",
                "description": "Read and write permissions to Azure Functions to create a Function App is required. [See the documentation to learn more about Azure Functions](https://docs.microsoft.com/azure/azure-functions/)."
            },
            {
                "name": "Wiz Service Account credentials",
                "description": "Ensure you have your Wiz service account client ID and client secret, API endpoint URL, and auth URL. Instructions can be found on [Wiz documentation](https://docs.wiz.io/wiz-docs/docs/azure-sentinel-native-integration#collect-authentication-info-from-wiz)."
            }
        ]
    },
    "instructionSteps": [
        {
            "description": ">**NOTE:** This connector: Uses Azure Functions to connect to Wiz API to pull Wiz Issues, Vulnerability Findings, and Audit Logs into Microsoft Sentinel. This might result in additional data ingestion costs. Check the [Azure Functions pricing page](https://azure.microsoft.com/pricing/details/functions/) for details.\nCreates an Azure Key Vault with all the required parameters stored as secrets."
        },
        {
            "description": "\nFollow the instructions on [Wiz documentation](https://docs.wiz.io/wiz-docs/docs/azure-sentinel-native-integration#collect-authentication-info-from-wiz) to get the erquired credentials.",
            "title": "STEP 1 - Get your Wiz credentials"
        },
        {
            "description": "\n>**IMPORTANT:** Before deploying the Wiz Connector, have the Workspace ID and Workspace Primary Key (can be copied from the following), as well as the Wiz credentials from the previous step.",
            "instructions": [
                {
                    "parameters": {
                        "fillWith": [
                            "WorkspaceId"
                        ],
                        "label": "Workspace ID"
                    },
                    "type": "CopyableLabel"
                },
                {
                    "parameters": {
                        "fillWith": [
                            "PrimaryKey"
                        ],
                        "label": "Primary Key"
                    },
                    "type": "CopyableLabel"
                }
            ],
            "title": "STEP 2 - Deploy the connector and the associated Azure Function"
        },
        {
            "description": "1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-wiz-azuredeploy) \n2. Select the preferred **Subscription**, **Resource Group** and **Location**. \n3. Enter the following parameters: \n> - Choose **KeyVaultName** and **FunctionName** for the new resources \n >- Enter the following Wiz credentials from step 1: **WizAuthUrl**, **WizEndpointUrl**, **WizClientId**, and **WizClientSecret** \n>- Enter the Workspace credentials **AzureLogsAnalyticsWorkspaceId** and **AzureLogAnalyticsWorkspaceSharedKey**\n>- Choose the Wiz data types you want to send to Microsoft Sentinel, choose at least one from **Wiz Issues**, **Vulnerability Findings**, and **Audit Logs**.\n \n>- (optional) follow [Wiz documentation](https://docs.wiz.io/wiz-docs/docs/azure-sentinel-native-integration#optional-create-a-filter-for-wiz-queries) to add **IssuesQueryFilter**, **VulnerbailitiesQueryFilter**, and **AuditLogsQueryFilter**.\n \n4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy.\n",
            "title": "Option 1: Deploy using the Azure Resource Manager (ARM) Template"
        },
        {
            "description": ">Follow [Wiz documentation](https://docs.wiz.io/wiz-docs/docs/azure-sentinel-native-integration#manual-deployment) to deploy the connector manually.",
            "title": "Option 2: Manual Deployment of the Azure Function"
        }
    ]
}