schema

Wiz Schema

graph LR
    WizTenant -- RESOURCE --> WizFinding
    WizTenant -- RESOURCE --> WizIssue

WizFinding

Conditional Labels:

  • CVE (ontology label) when has_cve equals true. A cross-provider CVE resource in Cartography's ontology.
  • SecurityIssue (ontology label) when is_security_issue equals true. A cross-provider SecurityIssue resource in Cartography's ontology.

Properties

Ontology-generated fields are shown in italics.

Field Index Description
id Yes Wiz finding ID.
firstseen Timestamp when a sync job first created this node.
lastupdated Yes Timestamp when this Wiz finding was last seen.
actor_ids Wiz actor IDs associated with the finding.
actor_names Wiz actor names associated with the finding.
cloud_account_ids Wiz cloud account IDs associated with the finding.
cloud_account_names Wiz cloud account names associated with the finding.
cloud_organization_ids Wiz cloud organization IDs associated with the finding.
cloud_organization_names Wiz cloud organization names associated with the finding.
created_at Timestamp when Wiz created the finding.
cve_description CVE description associated with the finding.
cve_id Yes CVE ID associated with the finding.
cvss_severity Yes CVSS severity associated with the finding.
description Wiz finding description.
detailed_name Detailed vulnerability or finding name from Wiz.
detection_method Wiz detection method for the finding.
exploitability_score CVSS exploitability score for the finding.
finding_type Yes Wiz finding family.
first_detected_at Timestamp when Wiz first detected the finding.
first_seen_at Timestamp when Wiz first saw the finding.
fixed_version Fixed package or component version.
has_cisa_kev_exploit Whether Wiz reports the CVE in the CISA KEV catalog.
has_cve Whether the finding has a CVE identifier.
has_exploit Whether Wiz reports a known exploit.
impact_score CVSS impact score for the finding.
is_security_issue Whether the finding is a non-CVE security issue.
last_detected_at Timestamp when Wiz last detected the finding.
link External reference URL for the finding.
location_path Affected file or runtime path for the finding.
name Yes Wiz finding name.
origins Wiz origins associated with the finding.
portal_url Wiz portal URL for the finding.
project_ids Yes Wiz project IDs associated with the finding.
project_names Wiz project names associated with the finding.
remediation Wiz remediation guidance for the finding.
resolution_reason Reason Wiz marked the finding resolved.
resolved_at Timestamp when Wiz resolved the finding.
resource_cloud_platform Cloud platform of the affected resource.
resource_external_id Yes Provider-native ID of the affected resource.
resource_id Yes Wiz ID of the affected resource.
resource_name Name of the affected Wiz resource.
resource_native_type Cloud-native type of the affected resource.
resource_region Cloud region of the affected resource.
resource_status Wiz status of the affected resource.
resource_type Yes Wiz type of the affected resource.
result Yes Wiz finding result.
rule_as_control Whether Wiz treats the rule as a control.
rule_builtin Whether the Wiz rule is built in.
rule_description Wiz rule description associated with the finding.
rule_graph_id Yes Wiz graph rule ID associated with the finding.
rule_id Yes Wiz rule ID associated with the finding.
rule_name Wiz rule name associated with the finding.
score CVSS score associated with the finding.
severity Yes Wiz finding severity.
status Yes Wiz finding status.
subscription_external_id Yes Provider-native subscription ID for the affected resource.
subscription_id Yes Wiz subscription ID for the affected resource.
subscription_name Subscription name for the affected resource.
target_external_id External ID of the Wiz finding target.
target_object_provider_unique_id Yes Provider-unique ID of the Wiz finding target.
triggering_event_ids Wiz triggering event IDs for the finding.
updated_at Timestamp when Wiz last updated the finding.
vendor_severity Yes Vendor-reported severity for the finding.
version Affected package or component version.
_ont_base_score Yes Normalized field sourced from score.
_ont_base_severity Yes Normalized field sourced from cvss_severity.
_ont_cve_id Yes Normalized field sourced from cve_id.
_ont_description Normalized field sourced from cve_description.
_ont_exploitability_score Yes Normalized field sourced from exploitability_score.
_ont_first_seen Yes Normalized field sourced from first_seen_at.
_ont_impact_score Yes Normalized field sourced from impact_score.
_ont_severity Yes Normalized field sourced from severity.
_ont_source Module that populated this node's ontology fields.
_ont_status Yes Normalized field sourced from status.
_ont_title Yes Normalized field sourced from name.
_ont_type Yes Normalized field sourced from finding_type.

Relationships

  • (:WizFinding)-[:LINKED_TO]->(:CVE)

  • (:WizTenant)-[:RESOURCE]->(:WizFinding)

WizIssue

Ontology Mapping: This node uses the ontology label SecurityIssue.

Properties

Ontology-generated fields are shown in italics.

Field Index Description
id Yes Wiz issue ID.
firstseen Timestamp when a sync job first created this node.
lastupdated Yes Timestamp when this Wiz issue was last seen.
control_description Wiz control description associated with the issue.
control_id Yes Wiz control ID associated with the issue.
control_name Wiz control name associated with the issue.
created_at Timestamp when Wiz created the issue.
due_at Wiz issue due timestamp.
issue_type Yes Wiz issue type.
name Yes Wiz issue name.
project_ids Yes Wiz project IDs associated with the issue.
project_names Wiz project names associated with the issue.
resolution_recommendation Wiz remediation guidance for the issue.
resolved_at Timestamp when Wiz resolved the issue.
resource_cloud_platform Cloud platform of the affected resource.
resource_external_id Yes Provider-native ID of the affected resource.
resource_id Yes Wiz ID of the affected resource.
resource_name Name of the affected Wiz resource.
resource_native_type Cloud-native type of the affected resource.
resource_type Yes Wiz type of the affected resource.
service_ticket_urls Service ticket URLs associated with the issue.
severity Yes Wiz issue severity.
source_rule_id Yes Wiz source rule ID for the issue.
source_rule_name Wiz source rule name for the issue.
status Yes Wiz issue status.
status_changed_at Timestamp when the Wiz issue status last changed.
updated_at Timestamp when Wiz last updated the issue.
_ont_first_seen Yes Normalized field sourced from created_at.
_ont_severity Yes Normalized field sourced from severity.
_ont_source Module that populated this node's ontology fields.
_ont_status Yes Normalized field sourced from status.
_ont_title Yes Normalized field sourced from name.
_ont_type Yes Normalized field sourced from issue_type.

Relationships

  • (:WizTenant)-[:RESOURCE]->(:WizIssue)

WizTenant

Ontology Mapping: This node uses the ontology label Tenant.

Properties

Field Index Description
id Yes Stable Wiz tenant identifier.
firstseen Timestamp when a sync job first created this node.
lastupdated Yes Timestamp when this Wiz tenant was last seen.
graphql_url Wiz GraphQL API endpoint used for this tenant.

Relationships

  • (:WizTenant)-[:RESOURCE]->(:WizFinding)

  • (:WizTenant)-[:RESOURCE]->(:WizIssue)

On this page
Wiz SchemaWizFindingWizIssueWizTenant