Wiz Scanner Parser

Wiz Scanner Parser Documentation

Overview#

The Wiz parser for DefectDojo supports imports from both Wiz Scanner Standard and SCA (Software Composition Analysis) .csv output from Wiz.io. This document details the parsing of both formats into DefectDojo field mappings, unmapped fields, and location of each field’s parsing code for easier troubleshooting and analysis.

Supported File Types#

The Wiz parser accepts CSV file format. There are two primary formats supported:

1. Standard Format - Issues exports with “Title” field (processed by WizParserByTitle class)
2. SCA Format - Vulnerability exports with “Name” and “DetailedName” fields (processed by WizParserByDetailedName class)

To generate these files, export the findings from the Wiz platform by:

• Standard Format: Select “Export to CSV” option from the Issues view in the Wiz.io platform
• SCA Format: Select “Export to CSV” option from the Vulnerability view in the Wiz.io platform

Standard Format CSV (WizParserByTitle)#

Total Fields in Standard Format CSV#

• Total data fields: 32
• Total data fields parsed: 32
• Total data fields NOT parsed: 0

Standard Format Field Mapping Details#

Additional Finding Field Settings (Standard Format)#

SCA Format (WizParserByDetailedName)#

Total Fields in SCA CSV#

• Total data fields: 41
• Total data fields parsed: 36
• Total data fields NOT parsed: 5

SCA Format Field Mapping Details#

Additional Finding Field Settings (SCA Format)#

Special Processing Notes#

Date Processing#

• Parser uses function parse_wiz_datetime() (lines 207-246) to handle different date formats from Wiz
• Handles both ISO8601 and custom Wiz timestamp formats

Status Conversion#

• Both parser formats use WizcliParsers.convert_status() function to determine finding status (active, mitigated, etc.)
• Standard format - if a finding is mitigated, the Resolved Time is used as the mitigated timestamp

Description Construction#

• Most CSV fields maintain field name as a prefix when added to the Finding description
• Description generated by iterating through predefined list of fields and adding data if present

Title Format#

• Standard format: Used directly from the “Title” field
• SCA format: Combines package name (DetailedName) and vulnerability ID (Name) in format “{package_name}: {vulnerability_id}”

Mitigation Construction#

• Standard format: Primary source is “Remediation Recommendation” field with optional “Resolution” field
• SCA format: Combines “Remediation”, “LocationPath”, and “FixedVersion” fields

Deduplication#

• Both formats use the respective ID field as the unique_id_from_tool for deduplication

Tags Handling (SCA Format)#

• “Tags” field is parsed from a JSON string format into a list of tag strings in format “key: value” (lines 186, 193-201)

Sample Scan Data#

Sample Wiz Scanner scans can be found in the sample scan data folder.

Link To Tool#

• Wiz.io
• Wiz Documentation