Wiz Backfill Integrations
Summarize
Summary of Wiz Backfill Integrations
The Wiz Backfill Integrations, prior to version 1.1, were designed to import and process details for Asset IDs flagged as missing by primary vulnerability integrations. With the release of version 1.1, these integrations are deprecated, and customers must backdate their primary Wiz integrations by three days post-upgrade.
Show less
Key Features
- The Missing Assets table (snvulwizmissingasset) for storing assets from backfill integrations is deprecated in version 1.1.
- Primary integrations can now automatically create discovered item records for missing assets without requiring backfill integrations.
- Activated backfill integrations include:
- Host Vulnerability Backfill Integration
- Test Results Backfill Integration
- Host Test Results Backfill Integration
- Issues Backfill Integration
- The backfill integrations process up to 100 records at a time from the Missing Assets table, initiating additional runs automatically for any remaining records.
Key Outcomes
After upgrading to version 1.1, customers can expect a streamlined process for handling missing assets. The primary integrations will efficiently reconcile discovered items, removing reconciled records from the Missing Assets table. Customers are encouraged to schedule and activate integrations on-demand for optimal operation.
Prior to v1.1, the Wiz Backfill integrations import and process details for your Assets IDs that are flagged as missing by the primary vulnerability integrations. Starting with v1.1, the backfill integrations are deprecated.
Upgrading to version 1.1
Starting with v1.1, the Missing Assets [sn_vul_wiz_missing_asset] table for storing assets from the backfill integrations is deprecated. After upgrading to version 1.1, you must backdate your primary Wiz integrations by three days and run them.
The Wiz Backfill Integrations are activated by default.
- Host Vulnerability Backfill Integration
- Test Results Backfill Integration
- Host Test Results Backfill Integration
- Issues Backfill Integration
Backfill Integrations overview (for versions prior to v1.1)
A backfill integration is a specialized Wiz integration that processes asset IDs that are reported as missing by the primary Wiz integration imports. Asset IDs flagged as missing, that is, their discovered item records are not found, are stored on the Wiz Missing Assets [sn_vul_wiz_missing_asset] table.
| Primary integration | Backfill integration | Integration type |
|---|---|---|
| Host Vulnerability Integration | Host Vulnerability Backfill Integration | host_vr |
| Test Results Integration | Test Results Backfill Integration | test_results |
| Host Test Results Integration | Host Test Results Backfill Integration | host_test_results |
| Issues Integration | Issues Backfill Integration | issues |
For example, the Wiz Host Vulnerability Backfill Integration is activated automatically after the Wiz Host Vulnerability Integration is successfully completed. The backfill integration imports and processes any Asset IDs (type host_vr) that are not found by the Host Vulnerability Integration.
If discovered items are found for these Asset IDs by the backfill integration, they are reconciled with their corresponding records and processed. If a corresponding discovered item record is not found, the backfill integration skips these assets, and they remain stored on the Missing Assets table. After records on the Wiz Missing Assets table are successfully reconciled with discovered item records, they are removed from the Missing Assets table.
The backfill integrations by default import and process 100 records on the Wiz Missing Assets table for their corresponding primary Wiz vulnerability integrations. If more than 100 records are found by a backfill integration, an additional integration run for the backfill integration is automatically initiated to process the remaining records.
For example, if the Test Results Integration runs and reports 120 missing Asset IDs, these are stored on the Wiz Missing Asset table. The Test Results Backfill integration is automatically activated to process 100 records for type, test_results. After this Test Results Backfill Integration run is completed, an additional run for the Test Results Backfill Integration is automatically activated to process the remaining 20 records.
Schedule and activate the integrations on-demand
See Schedule the Wiz Vulnerability Integrations for more information about activating the integrations on-demand and scheduling integration runs.