[Wiz] Added Dashboards for all the Data Streams #8154

mohitjha-elastic · 2023-10-10T13:24:57Z

Type of change

Enhancement

What does this PR do?

Add dashboards for all the data streams.
Set unknown to the event.outcome in the pipeline.

Checklist

I have reviewed tips for building integrations and this pull request is aligned with them.
I have verified that all data streams collect metrics or logs.
I have added an entry to my package's changelog.yml file.
I have verified that Kibana version constraints are current according to guidelines.

How to test this PR locally

Clone integrations repo.
Install the elastic package locally.
Start elastic stack using the elastic package.
Move to integrations/packages/wiz directory.
Run the following command to run tests.

Automated Test

test-file.txt

…wn in the pipeline.

elasticmachine · 2023-10-10T13:28:50Z

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

Start Time: 2023-10-13T12:26:16.917+0000
Duration: 19 min 35 sec

Test stats 🧪

Test	Results
Failed	0
Passed	18
Skipped	0
Total	18

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

/test : Re-trigger the build.

jamiehynds · 2023-10-10T13:47:22Z

@mohitjha-elastic for the Audit dashboard, could we replace the 'Total Audit' visualisation with 'Audit Events by User', with a pie-chart, breaking down the audit events by user.id. This is likely more useful than displaying the total number of audit events, and can identify Wiz admins/users who have performed the most actions within the Wiz console.

jamiehynds · 2023-10-10T13:48:59Z

packages/wiz/_dev/build/docs/README.md

-This [Wiz](https://www.wiz.io/) integration enables your security team to continuously prioritize critical risks based on a deep cloud analysis across misconfigurations, network exposure, secrets, vulnerabilities, malware, sensitive data and identities to build a single prioritized risk view for your cloud.
-
-Use the Wiz integration to collect and parse data from Wiz api.
+Wiz continuously prioritizes critical risks based on a deep cloud analysis across misconfigurations, network exposure, secrets, vulnerabilities, malware, and identities to build a single prioritized view of risk for your cloud. This [Wiz](https://www.wiz.io/) integration enables you to consume and analyze Wiz data within Elastic Security, including issues, vulnerability data and audit events, providing you with visibility and context for your cloud environments within Elastic Security.

 ## Data streams

 The Wiz integration collects three types of data: Audit, Issue and Vulnerability.


Can we remove the audit, issue and vulnerability sentences below as this sentence already covers the fact that we support audit, issue and vulnerability.

elasticmachine · 2023-10-10T17:14:37Z

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

efd6 · 2023-10-10T20:52:52Z

/test

elasticmachine · 2023-10-10T21:10:31Z

🌐 Coverage report

Name	Metrics % (`covered/total`)	Diff
Packages	100.0% (`3/3`)	💚
Files	100.0% (`3/3`)	💚 3.301
Classes	100.0% (`3/3`)	💚 3.301
Methods	100.0% (`39/39`)	💚 7.382
Lines	94.011% (`1146/1219`)	👍 5.622
Conditionals	100.0% (`0/0`)	💚

kcreddy · 2023-10-11T08:35:35Z

packages/wiz/changelog.yml

+  changes:
+    - description: Add dashboards for all the data streams.
+      type: enhancement
+      link: hhttps://github.com/elastic/integrations/pull/8154


Suggested change

link: hhttps://github.com/elastic/integrations/pull/8154

link: https://github.com/elastic/integrations/pull/8154

kcreddy · 2023-10-11T08:40:06Z

packages/wiz/kibana/dashboard/wiz-be3fd3f0-6358-11ee-9db4-21f79f2e6273.json

+                                                    "customLabel": true,
+                                                    "dataType": "number",
+                                                    "isBucketed": false,
+                                                    "label": "Count of Audit",


Suggested change

"label": "Count of Audit",

"label": "Count of Audit Events",

kcreddy · 2023-10-11T13:47:17Z

/test

kcreddy

LGTM. We can merge after Jamie's approval.

piyush-elastic · 2023-10-12T07:32:50Z

packages/wiz/kibana/dashboard/wiz-927c36f0-6358-11ee-a265-c3569aa0cebf.json

+                        "id": "",
+                        "params": {
+                            "fontSize": 12,
+                            "markdown": "Navigation\n\n[Wiz Vulnerability (This page)](#/dashboard/wiz-927c36f0-6358-11ee-a265-c3569aa0cebf)\n\n[Wiz Issue](#/dashboard/wiz-d8f91a20-6363-11ee-a265-c3569aa0cebf)\n\n[Wiz Audit](#/dashboard/wiz-be3fd3f0-6358-11ee-9db4-21f79f2e6273)\n\n[Integration Page](/app/integrations/detail/wiz-0.1.0/overview)\n\nOverview\n\nThis dashboard shows Vulnerability overview related to the Wiz Integration.\n\nThis dashboard is made to provide general statistics and show the detection of ingested vulnerabilities.\n\nIt provides information about vulnerability and vulnerability assets. It also displays the distribution of vulnerabilities according to detection method and status. It also contains details regarding count of vulnerabilities over time.",


Can we change the navigation to the latest version ?
wiz-0.1.0/overview -> wiz-0.2.0/overview

jamiehynds · 2023-10-12T11:16:48Z

packages/wiz/img/wiz-issue-dashboard.png

@mohitjha-elastic is Event ID the only field we can use in the Issue Details and Issues over Time? Anything that's more human readable like 'Issue Name' or something along those lines? Can we also adjust 'Issues over Timestamp' to 'Issues over Time' (sounds better). Sorry the last minute adjustment.

Hey @jamiehynds,
We do not have any other fields like the issue name or others so we have been using the Event ID only. However, the Event ID is the Issue ID but we are using the ECS name in the dashboard, let me know if you want us to replace the name Event ID with Issue ID.

No worries, will adjust Issues over Timestamp to Issue over Time.

@mohitjha-elastic ok, if the Event ID is the best we can do we can leave it there for now. Would be great to hyperlink each Event ID so users could go to the Wiz console from the dashboard in order to view more information about the Event, but not sure if that's possible?

We can go ahead and merge, but Wiz may have suggestions during the validation process and we can make adjustments if necessary

I guess it won't be possible to redirect from the Event ID to the Wiz console.
Also, we have adjusted the Issues over Timestamp to Issue over Time.

elasticmachine · 2023-10-13T13:11:11Z

Package wiz - 0.2.0 containing this change is available at https://epr.elastic.co/search?package=wiz

Added dashboards for all the data streams. Set event.outcome to unkno…

f987bb2

…wn in the pipeline.

mohitjha-elastic requested a review from a team as a code owner October 10, 2023 13:24

Update in the changelog entry

10d35c4

jamiehynds reviewed Oct 10, 2023

View reviewed changes

jamiehynds requested a review from a team October 10, 2023 17:14

jamiehynds added the Team:Security-External Integrations label Oct 10, 2023

jamiehynds added the Integration:wiz Wiz label Oct 10, 2023

kcreddy reviewed Oct 11, 2023

View reviewed changes

Resolve review comments.

146b19d

mohitjha-elastic requested review from jamiehynds and kcreddy October 11, 2023 12:44

kcreddy approved these changes Oct 12, 2023

View reviewed changes

jamiehynds approved these changes Oct 12, 2023

View reviewed changes

piyush-elastic reviewed Oct 12, 2023

View reviewed changes

Update navigation link of integration to the latest in the dashboards

03a3439

mohitjha-elastic requested a review from piyush-elastic October 12, 2023 09:19

piyush-elastic approved these changes Oct 12, 2023

View reviewed changes

jamiehynds reviewed Oct 12, 2023

View reviewed changes

Change in name of one viz

975d9db

P1llus merged commit c493cf1 into elastic:main Oct 13, 2023

	link: hhttps://github.com/elastic/integrations/pull/8154
	link: https://github.com/elastic/integrations/pull/8154

[Wiz] Added Dashboards for all the Data Streams #8154

[Wiz] Added Dashboards for all the Data Streams #8154

Uh oh!

Conversation

mohitjha-elastic commented Oct 10, 2023

What does this PR do?

Checklist

How to test this PR locally

Automated Test

Uh oh!

elasticmachine commented Oct 10, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

💚 Build Succeeded

Build stats

Test stats 🧪

🤖 GitHub comments

Uh oh!

jamiehynds commented Oct 10, 2023

Uh oh!

Choose a reason for hiding this comment

Uh oh!

elasticmachine commented Oct 10, 2023

Uh oh!

efd6 commented Oct 10, 2023

Uh oh!

elasticmachine commented Oct 10, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🌐 Coverage report

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

kcreddy commented Oct 11, 2023

Uh oh!

kcreddy left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

elasticmachine commented Oct 13, 2023

Uh oh!

Uh oh!

elasticmachine commented Oct 10, 2023 •

edited

Loading

elasticmachine commented Oct 10, 2023 •

edited

Loading