Export findings to Wiz

Endor Labs provides a holistic view of your code and software supply chain security so you can focus on the findings that matter most. Endor Labs pushes findings to Wiz after every scheduled scan on the default branch and maps them to Wiz’s enrichment schemas.

Export findings from Endor Labs to Wiz by establishing a secure connection with Wiz API endpoints. The integration sends SCA and SAST findings identified during repository scans to Wiz, and Wiz ingests them into the Wiz Security Graph.

Prerequisites

Ensure that the following prerequisites are complete:

• To use the Endor Labs integration, your Wiz tenant must have the Wiz Code License.

• Connect your source code manager to Wiz so that Wiz scans repositories and findings become available. Wiz currently supports the following providers:

  • GitHub
  • GitLab
  • Bitbucket
  • Azure DevOps

  This connection ensures that REPOSITORY_BRANCH assets exist in Wiz’s inventory. Without this connection, Wiz accepts findings but SKIPS them during ingestion because Wiz cannot resolve the repository.

• Add the Endor Labs integration from the Wiz Integration Network. When you create the integration, Wiz shows the required API scopes for the service account. Save the following values because you will need them when creating the Wiz exporter in Endor Labs:

  • Client ID
  • Client Secret
  • API Endpoint URL
  • Authentication URL

• Download and install endorctl. See Install endorctl.

Create a Wiz exporter

Create a Wiz exporter with the Endor Labs API to configure the export destination and data types.

The following table lists the configuration options required to create the exporter.

Run the following command to create a Wiz exporter.

endorctl api create \
  --namespace=<namespace> \
  --resource=Exporter \
  --data '{
    "meta": {
      "name": "<exporter-name>"
    },
    "propagate": true,
    "spec": {
      "exporter_type": "EXPORTER_TYPE_WIZ",
      "wiz_config": {
        "api_endpoint_url": "<api-endpoint-url>",
        "oauth_client_credentials": {
          "auth_endpoint_url": "<auth-endpoint-url>",
          "client_id": "<client-id>",
          "client_secret": "<client-secret>"
        }
      },
      "message_type_configs": [
        {
          "message_type": "MESSAGE_TYPE_FINDING",
          "message_export_format": "MESSAGE_EXPORT_FORMAT_JSON"
        }
      ]
    }
  }'

For example, to create a Wiz exporter named wiz-findings-export in the namespace doe.deer that exports findings to Wiz:

endorctl api create \
  --namespace=doe.deer \
  --resource=Exporter \
  --data '{
    "meta": {
      "name": "wiz-findings-export"
    },
    "propagate": true,
    "spec": {
      "exporter_type": "EXPORTER_TYPE_WIZ",
      "wiz_config": {
        "api_endpoint_url": "https://api.us18.app.wiz.io/graphql",
        "oauth_client_credentials": {
          "auth_endpoint_url": "https://auth.app.wiz.io/oauth/token",
          "client_id": "your-wiz-client-id",
          "client_secret": "your-wiz-client-secret"
        }
      },
      "message_type_configs": [
        {
          "message_type": "MESSAGE_TYPE_FINDING",
          "message_export_format": "MESSAGE_EXPORT_FORMAT_JSON"
        }
      ]
    }
  }'

Configure the scan profile to use the Wiz exporter

After creating the exporter, associate it with your scan profile. You can also set the scan profile as the default for your namespace so all projects use it automatically. See Scan profiles for more information.

Configure the scan profile

1. Select Settings from the left sidebar.
2. Select Scan Profiles.
3. Select the scan profile you want to configure and click Edit Scan Profile.
4. Select your exporter under Exporters and click Save Scan Profile.

Configure the project to use the scan profile

Associate your project with a scan profile to enable automatic export of scan data.

1. Select Projects from the left sidebar and select the project you want to configure.
2. Select Settings and select the scan profile you want to use under Scan Profile.

View findings in Wiz

Once Wiz successfully ingests findings, you can view them directly in the Wiz Findings dashboard. Wiz correlates these findings with your cloud assets and repositories in the Wiz Security Graph. You can filter by origin to easily locate findings from Endor Labs.

Finding lifecycle in Wiz

Endor Labs exports findings to Wiz after every scheduled scan on the default branch. Wiz manages finding state based on data sources:

• Full state snapshot: Each upload represents the complete current state of findings for a project and branch. Wiz treats it as a full replacement.
• Upload limit: Wiz allows up to three uploads per branch per day. Wiz may not process additional uploads for the same branch within 24 hours.
• Automatic resolution: If a finding was present in a previous upload but is absent in the current upload for the same scope, Wiz automatically marks it as resolved and closes any associated Wiz Issues.
• Staleness: Findings not refreshed within 7 days are automatically removed by Wiz. Wiz recommends uploading at least every 24 hours to align with their scanning cycle.

Ingestion status

When an upload completes, Wiz processes the results asynchronously.

The following table lists the ingestion outcomes.

FAQs