About

The Wiz NetoFuse module provides enriched asset context to Netography Fusion from the Wiz Cloud Security Platform. It gathers vulnerability, issue, and network exposure data about the cloud assets in your environment from the Wiz API, and uploads that data as Context Labels to the Netography Fusion API.

☁️

NetoFuse Modules: Cloud deployment vs. On-Prem deployment

This page documents how to add and configure the NetoFuse module for an on-prem deployment with a container or Python package. If you want to use the cloud deployment model and have this integration run in the Netography Fusion SaaS, you can add it as a context integration in the Netography Fusion Portal instead by consulting the Context Integrations documentation.

Use cases

Reduce investigation time

An AWS EC2 instance that has only ever communicated to the corporate network makes a new outbound connection to China. You may want to know more about this EC2 instance as you investigate this. The vulnerability context provided by Wiz is immediately available to you without having to pivot to another tool or ask another analyst with direct access to Wiz for this information.

Enhance monitoring for vulnerable assets

Cloud assets with high-severity vulnerabilities are at higher risk of being exploited and becoming the source of malicious activity. Now that the vulnerability state of these assets is directly available, you can use that information to monitor these assets, including:

• Creating and viewing dashboards focused on activity from the most vulnerable assets
• Create a custom escalation workflow for network activity, such as potential network scanning or exfiltration when it comes from a highly vulnerable asset
• Build custom detections that include the vulnerability state of the asset

You can use the following NQL to accomplish this:
label.ip.cvss_rating == critical || label.ip.cvss_rating == high

Monitor network activity for assets with high-profile vulnerabilities while they are being remediated

A new vulnerability has been released and is being actively exploited in cloud environments. You can focus your attention on the network activity for assets that Wiz has identified as vulnerable to this issue. By watching the assets with a highly visible vulnerability more closely, you can identify potential indicators of compromise and act on them during the critical period before the vulnerability is remediated.

You can use the following NQL to accomplish this:
label.ip.cve == CVE-2023-0123

Context Labels

These context labels are written when using the default module configuration.

If network exposures are enabled, the following additional context labels are available:

If issue monitoring is enabled, the following additional context labels are available:

ℹ️

The Wiz NetoFuse module is named wiz2

The first version of Wiz context integration pre-dated NetoFuse and was available only for cloud deployment. The new version is a NetoFuse module, so it is named wiz2 to differentiate it from the original context integration.

Configuring

Configure a service account

A Wiz Service Account is used to authenticate with the Wiz Integration API. The service account must possess these listed permissions:

Consult Wiz documentation for the steps needed to create this account and configure permissions.

API parameters required

All the fields required for this integration are listed here.

wiz2 NetoFuse Module Configuration

All the fields required for this integration are listed above in the API Configuration Parameters section. See Configure > module for additional options for setting configuration fields and Credential Storage for additional options for setting credentials.

Advanced Configuration Options

The following configuration options are available for the module.

Default wiz2 Module Configuration

wiz2:
    token_url:
    endpoint_url:
    audience:
    project_id:
    credentials:
      client_id:
      client_secret:
    severities:
    fetch_issues:
    fetch_network_exposures:
    issue_report_id:
    transform:
      vulnerableAsset.ipAddresses:
        context: ip
      vulnerableAsset.operatingSystem:
        context: os
        function:
          function: transform_os
      score:
        context: cvss_score
      cve:
        context: cve
      CVSSSeverity:
        context: cvss_rating
      vulnerableAsset.name:
        context: wiz_asset_name
      issue_id:
        context: wiz_issue_id
      issue_title:
        context: wiz_issue_title
      issue_severity:
        context: wiz_issue_severity
      issue_status:
        context: wiz_issue_status
      issue_type:
        context: wiz_issue_type
      vuln_count:
        context: vuln_count
      network_max_severity:
        context: wiz_network_max_severity
      network_max_severity_value:
        context: wiz_network_max_severity_value
      network_max_severity_description:
        context: wiz_network_max_severity_description
      removed:
        context: removed