[wiz] Add defend data stream #13688

muskan-agarwal26 · 2025-04-25T16:18:12Z

Proposed commit message

This release includes a defend data stream for supporting detection events forwarding via HTTP Endpoint and associated dashboards and visualizations.

Wiz fields are mapped to their corresponding ECS fields where possible.

Test samples were derived from documentation and subsequently sanitized.

Checklist

I have reviewed tips for building integrations and this pull request is aligned with them.
I have verified that all data streams collect metrics or logs.
I have added an entry to my package's changelog.yml file.
I have verified that Kibana version constraints are current according to guidelines.
I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test this PR locally

Clone integrations repo.
Install elastic package locally.
Start elastic stack using elastic-package.
Move to integrations/packages/wiz directory.
Run the following command to run tests.

elastic-package-test

--- Test results for package: wiz - START ---
╭─────────┬──────────────────────────────────────────┬───────────┬───────────────────────────────────────────────────────────────────────────────────┬────────┬──────────────╮
│ PACKAGE │ DATA STREAM                              │ TEST TYPE │ TEST NAME                                                                         │ RESULT │ TIME ELAPSED │
├─────────┼──────────────────────────────────────────┼───────────┼───────────────────────────────────────────────────────────────────────────────────┼────────┼──────────────┤
│ wiz     │                                          │ asset     │ dashboard wiz-3c3519be-f4f9-4c67-a9d8-1db4182b6e6a is loaded                      │ PASS   │      2.543µs │
│ wiz     │                                          │ asset     │ dashboard wiz-726802c0-4007-48b9-bae5-09daa69d4368 is loaded                      │ PASS   │        375ns │
│ wiz     │                                          │ asset     │ dashboard wiz-927c36f0-6358-11ee-a265-c3569aa0cebf is loaded                      │ PASS   │        383ns │
│ wiz     │                                          │ asset     │ dashboard wiz-be3fd3f0-6358-11ee-9db4-21f79f2e6273 is loaded                      │ PASS   │        390ns │
│ wiz     │                                          │ asset     │ dashboard wiz-d8f91a20-6363-11ee-a265-c3569aa0cebf is loaded                      │ PASS   │        400ns │
│ wiz     │                                          │ asset     │ search wiz-f71321c0-a641-4411-a33e-f39569c2c7be is loaded                         │ PASS   │        431ns │
│ wiz     │ audit                                    │ asset     │ index_template logs-wiz.audit is loaded                                           │ PASS   │        328ns │
│ wiz     │ audit                                    │ asset     │ ingest_pipeline logs-wiz.audit-3.2.0 is loaded                                    │ PASS   │        337ns │
│ wiz     │ cloud_configuration_finding              │ asset     │ index_template logs-wiz.cloud_configuration_finding is loaded                     │ PASS   │        229ns │
│ wiz     │ cloud_configuration_finding              │ asset     │ ingest_pipeline logs-wiz.cloud_configuration_finding-3.2.0 is loaded              │ PASS   │        310ns │
│ wiz     │ cloud_configuration_finding_full_posture │ asset     │ index_template logs-wiz.cloud_configuration_finding_full_posture is loaded        │ PASS   │        393ns │
│ wiz     │ cloud_configuration_finding_full_posture │ asset     │ ingest_pipeline logs-wiz.cloud_configuration_finding_full_posture-3.2.0 is loaded │ PASS   │        594ns │
│ wiz     │ defend                                   │ asset     │ index_template logs-wiz.defend is loaded                                          │ PASS   │        371ns │
│ wiz     │ defend                                   │ asset     │ ingest_pipeline logs-wiz.defend-3.2.0 is loaded                                   │ PASS   │        287ns │
│ wiz     │ issue                                    │ asset     │ index_template logs-wiz.issue is loaded                                           │ PASS   │        460ns │
│ wiz     │ issue                                    │ asset     │ ingest_pipeline logs-wiz.issue-3.2.0 is loaded                                    │ PASS   │        348ns │
│ wiz     │ vulnerability                            │ asset     │ index_template logs-wiz.vulnerability is loaded                                   │ PASS   │        527ns │
│ wiz     │ vulnerability                            │ asset     │ ingest_pipeline logs-wiz.vulnerability-3.2.0 is loaded                            │ PASS   │        419ns │
╰─────────┴──────────────────────────────────────────┴───────────┴───────────────────────────────────────────────────────────────────────────────────┴────────┴──────────────╯
--- Test results for package: wiz - END   ---
Done
--- Test results for package: wiz - START ---
╭─────────┬──────────────────────────────────────────┬───────────┬──────────────────────────────────────────────────────────────────────────────┬────────┬──────────────╮
│ PACKAGE │ DATA STREAM                              │ TEST TYPE │ TEST NAME                                                                    │ RESULT │ TIME ELAPSED │
├─────────┼──────────────────────────────────────────┼───────────┼──────────────────────────────────────────────────────────────────────────────┼────────┼──────────────┤
│ wiz     │ audit                                    │ pipeline  │ (ingest pipeline warnings test-audit.log)                                    │ PASS   │ 333.297311ms │
│ wiz     │ audit                                    │ pipeline  │ test-audit.log                                                               │ PASS   │ 169.366958ms │
│ wiz     │ cloud_configuration_finding              │ pipeline  │ (ingest pipeline warnings test-cloud-configuration-finding.log)              │ PASS   │ 320.289194ms │
│ wiz     │ cloud_configuration_finding              │ pipeline  │ test-cloud-configuration-finding.log                                         │ PASS   │ 201.247099ms │
│ wiz     │ cloud_configuration_finding_full_posture │ pipeline  │ (ingest pipeline warnings test-cloud-configuration-finding-full-posture.log) │ PASS   │ 321.040186ms │
│ wiz     │ cloud_configuration_finding_full_posture │ pipeline  │ test-cloud-configuration-finding-full-posture.log                            │ PASS   │ 206.083922ms │
│ wiz     │ defend                                   │ pipeline  │ (ingest pipeline warnings test-defend.json)                                  │ PASS   │ 387.764675ms │
│ wiz     │ defend                                   │ pipeline  │ test-defend.json                                                             │ PASS   │ 198.057461ms │
│ wiz     │ issue                                    │ pipeline  │ (ingest pipeline warnings test-issue.log)                                    │ PASS   │  348.22258ms │
│ wiz     │ issue                                    │ pipeline  │ test-issue.log                                                               │ PASS   │ 144.471151ms │
│ wiz     │ vulnerability                            │ pipeline  │ (ingest pipeline warnings test-vulnerability.log)                            │ PASS   │ 325.757313ms │
│ wiz     │ vulnerability                            │ pipeline  │ test-vulnerability.log                                                       │ PASS   │  234.06407ms │
╰─────────┴──────────────────────────────────────────┴───────────┴──────────────────────────────────────────────────────────────────────────────┴────────┴──────────────╯
--- Test results for package: wiz - END   ---
Done
--- Test results for package: wiz - START ---
No test results
--- Test results for package: wiz - END   ---
Done
--- Test results for package: wiz - START ---
╭─────────┬──────────────────────────────────────────┬───────────┬──────────────────────────┬────────┬──────────────╮
│ PACKAGE │ DATA STREAM                              │ TEST TYPE │ TEST NAME                │ RESULT │ TIME ELAPSED │
├─────────┼──────────────────────────────────────────┼───────────┼──────────────────────────┼────────┼──────────────┤
│ wiz     │ audit                                    │ static    │ Verify sample_event.json │ PASS   │ 113.858876ms │
│ wiz     │ cloud_configuration_finding              │ static    │ Verify sample_event.json │ PASS   │ 123.496495ms │
│ wiz     │ cloud_configuration_finding_full_posture │ static    │ Verify sample_event.json │ PASS   │ 122.217907ms │
│ wiz     │ defend                                   │ static    │ Verify sample_event.json │ PASS   │ 163.516688ms │
│ wiz     │ issue                                    │ static    │ Verify sample_event.json │ PASS   │ 136.472605ms │
│ wiz     │ vulnerability                            │ static    │ Verify sample_event.json │ PASS   │ 129.295156ms │
╰─────────┴──────────────────────────────────────────┴───────────┴──────────────────────────┴────────┴──────────────╯
--- Test results for package: wiz - END   ---
Done
--- Test results for package: wiz - START ---
╭─────────┬──────────────────────────────────────────┬───────────┬───────────────────────┬────────┬─────────────────╮
│ PACKAGE │ DATA STREAM                              │ TEST TYPE │ TEST NAME             │ RESULT │    TIME ELAPSED │
├─────────┼──────────────────────────────────────────┼───────────┼───────────────────────┼────────┼─────────────────┤
│ wiz     │ audit                                    │ system    │ default               │ PASS   │    45.60173321s │
│ wiz     │ cloud_configuration_finding              │ system    │ default               │ PASS   │ 2m12.569045322s │
│ wiz     │ cloud_configuration_finding_full_posture │ system    │ default               │ PASS   │   38.802608336s │
│ wiz     │ defend                                   │ system    │ http-endpoint-basic   │ PASS   │  2m8.851497915s │
│ wiz     │ defend                                   │ system    │ http-endpoint-no-auth │ PASS   │ 2m17.957363166s │
│ wiz     │ defend                                   │ system    │ http-endpoint-token   │ PASS   │ 2m17.895710817s │
│ wiz     │ issue                                    │ system    │ default               │ PASS   │    37.66306986s │
│ wiz     │ vulnerability                            │ system    │ default               │ PASS   │  4m4.630782448s │
╰─────────┴──────────────────────────────────────────┴───────────┴───────────────────────┴────────┴─────────────────╯
--- Test results for package: wiz - END   ---
Done

Related issues

- Closes Add support for Wiz Defend datastream #13269

Screenshots

elasticmachine · 2025-04-25T20:04:32Z

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

efd6 · 2025-04-28T04:21:50Z

/test

elastic-vault-github-plugin-prod · 2025-04-28T04:48:04Z

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

efd6 · 2025-04-28T04:24:28Z

packages/wiz/_dev/build/docs/README.md

+- (Recommended) Obtain or generate authentication info for the third-party product, either a username/password or an authentication token.
+
+2. Add a webhook Integration in Wiz
+- In Wiz, go to the  Settings > Integrations page, then click Add Integration.


Suggested change

- In Wiz, go to the Settings > Integrations page, then click Add Integration.

- In Wiz, go to the Settings > Integrations page, then click Add Integration.

efd6 · 2025-04-28T04:26:21Z

packages/wiz/_dev/deploy/docker/sample_logs/defend.log

@@ -0,0 +1 @@
+{"trigger":{"source":"DETECTIONS","type":"Created","ruleId":"a08fe977-3f54-48bf-adcf-f76994739c1f","ruleName":"Detections Webhook Test Rule"},"id":"6a440e9b-c8d8-5482-a0e9-da714359aecf","threatId":"733edfe5-db25-5b14-ac58-dc69d6005c81","threatURL":"https:\/\/test.wiz.io\/issues#~(issue~'733edfe5-db25-5b14-ac58-dc69d6005c81)","title":"Timestomping technique was detected","description":"Process executed the touch binary with the relevant command line flag used to modify files date information such as creation time, and last modification time. This could indicate the presence of a threat actor achieving defense evasion using the Timestomping technique.","severity":"MEDIUM","createdAt":"2025-01-21T18:52:16.819883668Z","tdrId":"46fd0cdc-252e-5e69-be6e-66e4851d7ae4","tdrSource":"WIZ_SENSOR","mitreTactics":["TA0005"],"mitreTechniques":["T1070.006"],"cloudAccounts":[{"cloudPlatform":"AWS","externalId":"134653897021","id":"5d67ed02-738e-5217-b065-d93642dd2629"}],"cloudOrganizations":[],"timeframe":{"start":"2025-01-21T18:52:15.838Z","end":"2025-01-21T18:52:15.838Z"},"actors":[{"externalId":"test-actor","id":"4e1bd57f-49b2-47a8-a4a7-0e66fe0b770e","name":"test-actor","nativeType":"Microsoft Entra ID Application Service Principal","type":"SERVICE_ACCOUNT"},{"externalId":"test-actor","id":"4e1bd57f-49b2-47a8-a4a7-0e66fe89770e","name":"test-actor","nativeType":"Microsoft Entra ID Application Service Principal","type":"SERVICE_ACCOUNT"}],"resources":[{"cloudAccount":{"cloudPlatform":"AWS","externalId":"134653897021","id":"5d67ed02-738e-5217-b065-d93642dd2629"},"externalId":"test-container","id":"da259b23-de77-5adb-8336-8c4071696305","name":"test-container","nativeType":"ecs#containerinstance","region":"us-east-1","type":"CONTAINER"}],"primaryResource":{"cloudAccount":{"cloudPlatform":"AWS","externalId":"134653897021","id":"5d67ed02-738e-5217-b065-d93642dd2629"},"externalId":"test-container","id":"da259b23-de77-5adb-8336-8c4071696305","name":"test-container","nativeType":"ecs#containerinstance","region":"us-east-1","type":"CONTAINER"},"triggeringEventsCount":2,"triggeringEvents":[{"actor":{"id":"4e1bd57f-49b2-47a8-a4a7-0e66fe0b770e"},"actorIP":"81.2.69.192","actorIPMeta":{"autonomousSystemNumber":8075,"autonomousSystemOrganization":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"United States","isForeign":true,"reputation":"Benign","reputationSource":"Recorded Future"},"category":"Detection","cloudPlatform":"AWS","cloudProviderUrl":"https:\/\/console.aws.amazon.com\/cloudtrail\/home?region=us-east-1#\/events\/Ptrace##test-container-SensorRuleEngine##sen-id-142-bd820642-34f2-4d3c-90b6-c384df0fd528","description":"The program \/usr\/bin\/bash executed the program \/usr\/bin\/touch on container test-container","eventTime":"2025-01-21T18:52:15.838Z","externalId":"Ptrace##test-container-SensorRuleEngine##sen-id-142-bd820642-34f2-4d3c-90b6-c384df0fd528","id":"2b46aa0d-9f46-5cb9-a6ae-e83ca514144a","name":"Timestomping technique was detected","origin":"WIZ_SENSOR","resources":[{"externalId":"test-container","id":"da259b23-de77-5adb-8336-8c4071696305","name":"test-container","nativeType":"ecs#containerinstance","region":"us-east-1","type":"CONTAINER"}],"runtimeDetails":{"processTree":[{"command":"touch -r \/usr\/bin \/tmp\/uga","container":{"externalId":"test-container","id":"da259b23-de77-5adb-8336-8c4071696305","imageExternalId":"sha256:dcad76015854d8bcab3041a631d9d25d777325bb78abfa8ab0882e1b85ad84bb","imageId":"d18500ef-c0f7-5028-8c4c-1cd56c3a6652","name":"test-container"},"executionTime":"2025-01-21T18:52:15.838Z","hash":"a0d0c6248d07a8fa8e3b6a94e218ff9c8c372ad6","id":"1560","path":"\/usr\/bin\/touch","size":109616,"userId":"0","username":"root"},{"command":"\/bin\/bash -x -c touch -r \/usr\/bin \/tmp\/uga","container":{"externalId":"test-container","id":"da259b23-de77-5adb-8336-8c4071696305","imageExternalId":"sha256:dcad76015854d8bcab3041a631d9d25d777325bb78abfa8ab0882e1b85ad84bb","imageId":"d18500ef-c0f7-5028-8c4c-1cd56c3a6652","name":"test-container"},"executionTime":"2025-01-21T18:52:15.838Z","hash":"91fbd9d8c65de48dc82a1064b8a4fc89f5651778","id":"1560","path":"\/usr\/bin\/bash","size":1265648,"userId":"0","username":"root"}]},"source":"WizSensorAlert##RuleEngine","status":"Success"},{"actor":{"id":"4e1bd57f-49b2-47a8-a4a7-0e66fe89770e"},"actorIP":"81.2.69.192","actorIPMeta":{"autonomousSystemNumber":8075,"autonomousSystemOrganization":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"United States","isForeign":true,"reputation":"Benign","reputationSource":"Recorded Future"},"category":"Detection","cloudPlatform":"AWS","cloudProviderUrl":"https:\/\/console.aws.amazon.com\/cloudtrail\/home?region=us-east-1#\/events\/Ptrace##test-container-SensorRuleEngine##sen-id-142-bd820642-34f2-4d3c-90b6-c384df0fd528","description":"The program \/usr\/bin\/bash executed the program \/usr\/bin\/touch on container test-container","eventTime":"2025-01-21T18:52:15.838Z","externalId":"Ptrace##test-container-SensorRuleEngine##sen-id-142-bd820642-34f2-4d3c-90b6-c384df0fd528","id":"2b46aa0d-9f46-5cb9-a6ae-e83ca514144a","name":"Timestomping technique was detected","origin":"WIZ_SENSOR","resources":[{"externalId":"test-container","id":"da259b23-de77-5adb-8336-8c4071696305","name":"test-container","nativeType":"ecs#containerinstance","region":"us-east-1","type":"CONTAINER"}],"runtimeDetails":{"processTree":[{"command":"touch -r \/usr\/bin \/tmp\/uga","container":{"externalId":"test-container","id":"da259b23-de77-5adb-8336-8c4071696305","imageExternalId":"sha256:dcad76015854d8bcab3041a631d9d25d777325bb78abfa8ab0882e1b85ad84bb","imageId":"d18500ef-c0f7-5028-8c4c-1cd56c3a6652","name":"test-container"},"executionTime":"2025-01-21T18:52:15.838Z","hash":"a0d0c6248d07a8fa8e3b6a94e218ff9c8c372ad6","id":"1560","path":"\/usr\/bin\/touch","size":109616,"userId":"0","username":"root"},{"command":"\/bin\/bash -x -c touch -r \/usr\/bin \/tmp\/uga","container":{"externalId":"test-container","id":"da259b23-de77-5adb-8336-8c4071696305","imageExternalId":"sha256:dcad76015854d8bcab3041a631d9d25d777325bb78abfa8ab0882e1b85ad84bb","imageId":"d18500ef-c0f7-5028-8c4c-1cd56c3a6652","name":"test-container"},"executionTime":"2025-01-21T18:52:15.838Z","hash":"91fbd9d8c65de48dc82a1064b8a4fc89f5651778","id":"1560","path":"\/usr\/bin\/bash","size":1265648,"userId":"0","username":"root"}]},"source":"WizSensorAlert##RuleEngine","status":"Success"}]}


There are a bunch of \/ that suggest this text was copied via a windows machine. Can you check whether the original data includes the unnecessary escapes chars and remove them if not?

packages/wiz/data_stream/audit/manifest.yml

efd6 · 2025-04-28T04:31:33Z

...l_posture/_dev/test/pipeline/test-cloud-configuration-finding-full-posture.log-expected.json

@@ -1,6 +1,7 @@
 {
    "expected": [
        {
+            "@timestamp": "2025-04-22T09:52:20.947712691Z",


I don't see a change in the ingest pipeline that explains why these are appearing now. Why are they here?

Yes, you’re right — we haven’t made any code changes to these data streams. However, while testing everything, we ran the command elastic-package system -v -g, which caused the above change to appear.
Just for your information, @timestamp is mapped to _ingest.timestamp.

Can you revert this then please?

efd6 · 2025-04-28T04:36:54Z

packages/wiz/data_stream/defend/agent/stream/http_endpoint.yml.hbs

+    ?"primaryResource": obj.?primaryResource,
+    ?"triggeringEventsCount": obj.?triggeringEventsCount,
+    "triggeringEvent": {
+      "actor": obj.actors.filter(a, a.id == r.actor.id)[0],


Are we guaranteed to receive the actor that corresponds to r.actor.id? If not,

Suggested change

"actor": obj.actors.filter(a, a.id == r.actor.id)[0],

?"actor": obj.actors.filter(a, a.id == r.actor.id)[?0],

in order to avoid an eval error.

How many actors/triggeringEvents are we receiving on average? Asking because of the n×m time behaviour this gives.

There is no documented limit on the number of actors we can receive; however, based on live logs, we are currently seeing a maximum of one actor.

The issue is not the maximum, but rather the minimum; if the result of obj.actors.filter(a, a.id == r.actor.id) is [], then the previous code would fail.

If there is a possibility of there being more than one, can we leave this as the array in its entirety?

efd6 · 2025-04-28T04:49:59Z

packages/wiz/data_stream/defend/agent/stream/http_endpoint.yml.hbs

+      ?"id": r.?id,
+      ?"name": r.?name,
+      ?"origin": r.?origin,
+      "resources": obj.resources.filter(re, (r.resources.map(r, r.id)).exists(id, id == re.id)),


Do you mean obj.resources.filter(re, r.resources.exists(r, r.id == re.id))? The map here allocates an array that's immediately dropped after the exists call. Even as I have it, I'm concerned about the time complexity of this. What is the intended behaviour?

We have a resources array of objects both outside and inside the triggeringEvent. Since the resources inside the triggeringEvent lack some fields present in the outside resources, we are mapping based on the id field from the inside array and enriching them using the corresponding objects from the outside array.

OK, in that case, please use the code I pasted above (untested, so please check that it does what you want).

packages/wiz/data_stream/defend/fields/fields.yml

packages/wiz/data_stream/issue/manifest.yml

efd6 · 2025-04-28T04:57:44Z

packages/wiz/kibana/dashboard/wiz-726802c0-4007-48b9-bae5-09daa69d4368.json

@@ -37,7 +37,7 @@
                        "id": "",
                        "params": {
                            "fontSize": 12,
-                            "markdown": "Navigation\n\n[Wiz Cloud Configuration Finding (This page)](#/dashboard/wiz-726802c0-4007-48b9-bae5-09daa69d4368)\n\n[Wiz Vulnerability](#/dashboard/wiz-927c36f0-6358-11ee-a265-c3569aa0cebf)\n\n[Wiz Issue](#/dashboard/wiz-d8f91a20-6363-11ee-a265-c3569aa0cebf)\n\n[Wiz Audit](#/dashboard/wiz-be3fd3f0-6358-11ee-9db4-21f79f2e6273)\n\n[Integration Page](/app/integrations/detail/wiz/overview)\n\nOverview\n\nThis dashboard shows the Cloud Configuration Findings overview related to the Wiz Integration.\n\nThis dashboard provides general statistics and shows the detection of ingested cloud configuration findings.\n\nIt provides information about findings and assets. It also displays the distribution of findings according to evaluation results and contains details regarding the count of findings over time.",
+                            "markdown": "Navigation\n\nWiz Cloud Configuration Finding\n\n[Wiz Vulnerability](#/dashboard/wiz-927c36f0-6358-11ee-a265-c3569aa0cebf)\n\n[Wiz Issue](#/dashboard/wiz-d8f91a20-6363-11ee-a265-c3569aa0cebf)\n\n[Wiz Defend](#/dashboard/wiz-3c3519be-f4f9-4c67-a9d8-1db4182b6e6a)\n\n[Wiz Audit](#/dashboard/wiz-be3fd3f0-6358-11ee-9db4-21f79f2e6273)\n\n[Integration Page](/app/integrations/detail/wiz/overview)\n\nOverview\n\nThis dashboard shows the Cloud Configuration Findings overview related to the Wiz Integration.\n\nThis dashboard provides general statistics and shows the detection of ingested cloud configuration findings.\n\nIt provides information about findings and assets. It also displays the distribution of findings according to evaluation results and contains details regarding the count of findings over time.",


Why does the order of the navigation list change for each of these pages?

We have not changed any order here. As suggested in the earlier PRs, we have added all the missing dashboard links. Additionally, for the dashboard we are currently on, we have removed the "(This Page)" text and the link to it, as previously recommended.

Yeah, sorry, I should have been clearer. The order is the same as it was, but the previously existing order differs depending on which dashboard the user is on. I was wondering why that is the case. You may not know.

packages/wiz/data_stream/vulnerability/manifest.yml

efd6 · 2025-04-28T22:32:43Z

/test

elasticmachine · 2025-04-28T22:59:00Z

💚 Build Succeeded

Buildkite Build
Commit: 54877af

History

💚 Build #25186 succeeded 6bb9ddc

elastic-sonarqube · 2025-04-28T22:59:07Z

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
98.8% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

Add defend data stream

14b0523

muskan-agarwal26 requested a review from a team as a code owner April 25, 2025 16:18

Update changelog entry

6bb9ddc

andrewkroh added dashboard Relates to a Kibana dashboard bug, enhancement, or modification. Integration:wiz Wiz Crest Contributions from Crest developement team. Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations] labels Apr 25, 2025

efd6 reviewed Apr 28, 2025

View reviewed changes

Resolved comments by @efd6

54877af

muskan-agarwal26 requested a review from efd6 April 28, 2025 09:23

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[wiz] Add defend data stream #13688

[wiz] Add defend data stream #13688

muskan-agarwal26 commented Apr 25, 2025

elasticmachine commented Apr 25, 2025

efd6 commented Apr 28, 2025

elastic-vault-github-plugin-prod bot commented Apr 28, 2025

efd6 Apr 28, 2025

efd6 Apr 28, 2025

efd6 Apr 28, 2025

muskan-agarwal26 Apr 28, 2025

efd6 Apr 28, 2025

efd6 Apr 28, 2025

muskan-agarwal26 Apr 28, 2025

efd6 Apr 28, 2025

efd6 Apr 28, 2025

efd6 Apr 28, 2025

muskan-agarwal26 Apr 28, 2025

efd6 Apr 28, 2025

efd6 Apr 28, 2025

muskan-agarwal26 Apr 28, 2025

efd6 Apr 28, 2025

efd6 commented Apr 28, 2025

elasticmachine commented Apr 28, 2025

elastic-sonarqube bot commented Apr 28, 2025

	- In Wiz, go to the Settings > Integrations page, then click Add Integration.
	- In Wiz, go to the Settings > Integrations page, then click Add Integration.

		@@ -0,0 +1 @@
		{"trigger":{"source":"DETECTIONS","type":"Created","ruleId":"a08fe977-3f54-48bf-adcf-f76994739c1f","ruleName":"Detections Webhook Test Rule"},"id":"6a440e9b-c8d8-5482-a0e9-da714359aecf","threatId":"733edfe5-db25-5b14-ac58-dc69d6005c81","threatURL":"https:\/\/test.wiz.io\/issues#~(issue~'733edfe5-db25-5b14-ac58-dc69d6005c81)","title":"Timestomping technique was detected","description":"Process executed the touch binary with the relevant command line flag used to modify files date information such as creation time, and last modification time. This could indicate the presence of a threat actor achieving defense evasion using the Timestomping technique.","severity":"MEDIUM","createdAt":"2025-01-21T18:52:16.819883668Z","tdrId":"46fd0cdc-252e-5e69-be6e-66e4851d7ae4","tdrSource":"WIZ_SENSOR","mitreTactics":["TA0005"],"mitreTechniques":["T1070.006"],"cloudAccounts":[{"cloudPlatform":"AWS","externalId":"134653897021","id":"5d67ed02-738e-5217-b065-d93642dd2629"}],"cloudOrganizations":[],"timeframe":{"start":"2025-01-21T18:52:15.838Z","end":"2025-01-21T18:52:15.838Z"},"actors":[{"externalId":"test-actor","id":"4e1bd57f-49b2-47a8-a4a7-0e66fe0b770e","name":"test-actor","nativeType":"Microsoft Entra ID Application Service Principal","type":"SERVICE_ACCOUNT"},{"externalId":"test-actor","id":"4e1bd57f-49b2-47a8-a4a7-0e66fe89770e","name":"test-actor","nativeType":"Microsoft Entra ID Application Service Principal","type":"SERVICE_ACCOUNT"}],"resources":[{"cloudAccount":{"cloudPlatform":"AWS","externalId":"134653897021","id":"5d67ed02-738e-5217-b065-d93642dd2629"},"externalId":"test-container","id":"da259b23-de77-5adb-8336-8c4071696305","name":"test-container","nativeType":"ecs#containerinstance","region":"us-east-1","type":"CONTAINER"}],"primaryResource":{"cloudAccount":{"cloudPlatform":"AWS","externalId":"134653897021","id":"5d67ed02-738e-5217-b065-d93642dd2629"},"externalId":"test-container","id":"da259b23-de77-5adb-8336-8c4071696305","name":"test-container","nativeType":"ecs#containerinstance","region":"us-east-1","type":"CONTAINER"},"triggeringEventsCount":2,"triggeringEvents":[{"actor":{"id":"4e1bd57f-49b2-47a8-a4a7-0e66fe0b770e"},"actorIP":"81.2.69.192","actorIPMeta":{"autonomousSystemNumber":8075,"autonomousSystemOrganization":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"United States","isForeign":true,"reputation":"Benign","reputationSource":"Recorded Future"},"category":"Detection","cloudPlatform":"AWS","cloudProviderUrl":"https:\/\/console.aws.amazon.com\/cloudtrail\/home?region=us-east-1#\/events\/Ptrace##test-container-SensorRuleEngine##sen-id-142-bd820642-34f2-4d3c-90b6-c384df0fd528","description":"The program \/usr\/bin\/bash executed the program \/usr\/bin\/touch on container test-container","eventTime":"2025-01-21T18:52:15.838Z","externalId":"Ptrace##test-container-SensorRuleEngine##sen-id-142-bd820642-34f2-4d3c-90b6-c384df0fd528","id":"2b46aa0d-9f46-5cb9-a6ae-e83ca514144a","name":"Timestomping technique was detected","origin":"WIZ_SENSOR","resources":[{"externalId":"test-container","id":"da259b23-de77-5adb-8336-8c4071696305","name":"test-container","nativeType":"ecs#containerinstance","region":"us-east-1","type":"CONTAINER"}],"runtimeDetails":{"processTree":[{"command":"touch -r \/usr\/bin \/tmp\/uga","container":{"externalId":"test-container","id":"da259b23-de77-5adb-8336-8c4071696305","imageExternalId":"sha256:dcad76015854d8bcab3041a631d9d25d777325bb78abfa8ab0882e1b85ad84bb","imageId":"d18500ef-c0f7-5028-8c4c-1cd56c3a6652","name":"test-container"},"executionTime":"2025-01-21T18:52:15.838Z","hash":"a0d0c6248d07a8fa8e3b6a94e218ff9c8c372ad6","id":"1560","path":"\/usr\/bin\/touch","size":109616,"userId":"0","username":"root"},{"command":"\/bin\/bash -x -c touch -r \/usr\/bin \/tmp\/uga","container":{"externalId":"test-container","id":"da259b23-de77-5adb-8336-8c4071696305","imageExternalId":"sha256:dcad76015854d8bcab3041a631d9d25d777325bb78abfa8ab0882e1b85ad84bb","imageId":"d18500ef-c0f7-5028-8c4c-1cd56c3a6652","name":"test-container"},"executionTime":"2025-01-21T18:52:15.838Z","hash":"91fbd9d8c65de48dc82a1064b8a4fc89f5651778","id":"1560","path":"\/usr\/bin\/bash","size":1265648,"userId":"0","username":"root"}]},"source":"WizSensorAlert##RuleEngine","status":"Success"},{"actor":{"id":"4e1bd57f-49b2-47a8-a4a7-0e66fe89770e"},"actorIP":"81.2.69.192","actorIPMeta":{"autonomousSystemNumber":8075,"autonomousSystemOrganization":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"United States","isForeign":true,"reputation":"Benign","reputationSource":"Recorded Future"},"category":"Detection","cloudPlatform":"AWS","cloudProviderUrl":"https:\/\/console.aws.amazon.com\/cloudtrail\/home?region=us-east-1#\/events\/Ptrace##test-container-SensorRuleEngine##sen-id-142-bd820642-34f2-4d3c-90b6-c384df0fd528","description":"The program \/usr\/bin\/bash executed the program \/usr\/bin\/touch on container test-container","eventTime":"2025-01-21T18:52:15.838Z","externalId":"Ptrace##test-container-SensorRuleEngine##sen-id-142-bd820642-34f2-4d3c-90b6-c384df0fd528","id":"2b46aa0d-9f46-5cb9-a6ae-e83ca514144a","name":"Timestomping technique was detected","origin":"WIZ_SENSOR","resources":[{"externalId":"test-container","id":"da259b23-de77-5adb-8336-8c4071696305","name":"test-container","nativeType":"ecs#containerinstance","region":"us-east-1","type":"CONTAINER"}],"runtimeDetails":{"processTree":[{"command":"touch -r \/usr\/bin \/tmp\/uga","container":{"externalId":"test-container","id":"da259b23-de77-5adb-8336-8c4071696305","imageExternalId":"sha256:dcad76015854d8bcab3041a631d9d25d777325bb78abfa8ab0882e1b85ad84bb","imageId":"d18500ef-c0f7-5028-8c4c-1cd56c3a6652","name":"test-container"},"executionTime":"2025-01-21T18:52:15.838Z","hash":"a0d0c6248d07a8fa8e3b6a94e218ff9c8c372ad6","id":"1560","path":"\/usr\/bin\/touch","size":109616,"userId":"0","username":"root"},{"command":"\/bin\/bash -x -c touch -r \/usr\/bin \/tmp\/uga","container":{"externalId":"test-container","id":"da259b23-de77-5adb-8336-8c4071696305","imageExternalId":"sha256:dcad76015854d8bcab3041a631d9d25d777325bb78abfa8ab0882e1b85ad84bb","imageId":"d18500ef-c0f7-5028-8c4c-1cd56c3a6652","name":"test-container"},"executionTime":"2025-01-21T18:52:15.838Z","hash":"91fbd9d8c65de48dc82a1064b8a4fc89f5651778","id":"1560","path":"\/usr\/bin\/bash","size":1265648,"userId":"0","username":"root"}]},"source":"WizSensorAlert##RuleEngine","status":"Success"}]}

	"actor": obj.actors.filter(a, a.id == r.actor.id)[0],
	?"actor": obj.actors.filter(a, a.id == r.actor.id)[?0],

[wiz] Add defend data stream #13688

Are you sure you want to change the base?

[wiz] Add defend data stream #13688

Conversation

muskan-agarwal26 commented Apr 25, 2025

Proposed commit message

Checklist

How to test this PR locally

Related issues

Screenshots

elasticmachine commented Apr 25, 2025

efd6 commented Apr 28, 2025

elastic-vault-github-plugin-prod bot commented Apr 28, 2025

🚀 Benchmarks report

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

efd6 commented Apr 28, 2025

elasticmachine commented Apr 28, 2025

💚 Build Succeeded

History

elastic-sonarqube bot commented Apr 28, 2025

Quality Gate passed