Parsing Wiz Issues

Query

WizIssuesV3_CL
| project
    TimeGenerated,
    CreatedAt = createdAt,
    UpdatedAt = updatedAt,
    ResolvedAt = resolvedAt,
    DueAt = dueAt,
    StatusChangedAt = statusChangedAt,
    Status = status,
    Severity = severity,
    IssueType = issueType,
    RuleSourceType = tostring(sourceRule["sourceType"]),
    RuleId = tostring(sourceRule["id"]),
    IssueId = issueId,
    IssueName = tostring(sourceRule["name"]),
    Description = tostring(sourceRule["description"]),
    ResolutionRecommendation = tostring(sourceRule["resolutionRecommendation"]),
    SourceRule = sourceRule,
    Projects = projects,
    ServiceTickets = serviceTickets,
    Notes = notes,
    IssueUrl = sourceURL,
    EntityType = tostring(entitySnapshot["type"]),
    EntityCloudPlatform = tostring(entitySnapshot["cloudPlatform"]),
    EntityRegion = tostring(entitySnapshot["region"]),
    EntitySubscriptionId = tostring(entitySnapshot["subscriptionExternalId"]),
    EntitySubscriptionName = tostring(entitySnapshot["subscriptionName"]),
    EntityResourceGroup = tostring(entitySnapshot["resourceGroupExternalId"]),
    EntityNativeType = tostring(entitySnapshot["nativeType"]),
    EntityName = tostring(entitySnapshot["name"]),
    EntityCreatedAt = todatetime(entitySnapshot["createdAt"]),
    EntityStatus = tostring(entitySnapshot["status"]),
    EntityCloudProviderUrl = tostring(entitySnapshot["cloudProviderURL"]),
    EntityExternalId = tostring(entitySnapshot["externalId"]),
    EntityProviderId = tostring(entitySnapshot["providerId"]),
    EntityId = tostring(entitySnapshot["id"]),
    EntityTags = entitySnapshot["tags"],
    EntitySnapshot = entitySnapshot,
    Evidence = set_union(evidence, dynamic(null))

Explanation

This KQL (Kusto Query Language) query is designed to extract and organize specific information from a data table named WizIssuesV3_CL. The query selects various fields from the table and renames some of them for clarity or convenience. Here's a simplified breakdown of what the query does:

Selects and Renames Columns: The query retrieves a set of columns from the WizIssuesV3_CL table. Some columns are renamed for clarity, such as CreatedAt for createdAt and UpdatedAt for updatedAt.
Extracts Specific Fields: It extracts specific fields related to issues, such as:
- Timestamps for when the issue was created, updated, resolved, due, and when its status changed.
- Details about the issue, including its status, severity, type, and a unique identifier (IssueId).
- Information about the rule that generated the issue, including its source type, ID, name, description, and resolution recommendation.
Includes Entity Details: The query also extracts details about the entity associated with the issue, such as:
- The type, cloud platform, region, subscription details, resource group, and native type of the entity.
- The entity's name, creation date, status, and various identifiers and URLs related to the cloud provider.
Additional Information: It includes additional fields like projects, service tickets, notes, and a URL for the issue.
Combines Evidence: The Evidence field is created by combining evidence data using the set_union function, which merges evidence data with a default value of null if no evidence is present.

Overall, this query is used to compile a comprehensive view of issues, their associated rules, and related entity details from the WizIssuesV3_CL table, making it easier to analyze and understand the context and status of each issue.

Details

Jose Sebastián Canós

Released: May 6, 2025

Tables

WizIssuesV3_CL

Keywords

WizIssuesEntityEntitySnapshotSourceRuleProjectsServiceTicketsNotesEvidence

Operators

projecttostringtodatetimeset_uniondynamic

Actions

GitHub