[wiz] Add Filters to Retrieve all Types of Vulnerabilities by mohitjha-elastic · Pull Request #14664 · elastic/integrations

mohitjha-elastic · 2025-07-23T07:24:31Z

Proposed commit message

wiz: add filters to retrieve all types of vulnerabilities in the vulnerability dataset

This change introduces filters to the vulnerability dataset, allowing
retrieval of all types of vulnerabilities. It enhances the dataset's
flexibility by ensuring comprehensive coverage across different
vulnerability categories.

Checklist

I have reviewed tips for building integrations and this pull request is aligned with them.
I have verified that all data streams collect metrics or logs.
I have added an entry to my package's changelog.yml file.
I have verified that Kibana version constraints are current according to guidelines.
I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test this PR locally

Clone integrations repo.
Install elastic package locally.
Start elastic stack using elastic-package.
Move to integrations/packages/wiz directory.
Run the following command to run tests.

elastic-package test -v

Related Issue

Closes Wiz: Vulnerability Datastream only retrieves OPEN vulnerabilities event #14437

…lity dataset

elasticmachine · 2025-07-23T07:24:35Z

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

elastic-vault-github-plugin-prod · 2025-07-23T07:53:34Z

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

efd6 · 2025-07-28T07:17:48Z

          "first": state.batch_size,
          "after": state.?end_cursor.value.orValue(null),
          "filterBy": {
+            "status": ["RESOLVED", "OPEN", "REJECTED", "IN_PROGRESS"],


I'm wondering whether we want this to be configurable?

cc @maxcold

We typically fetch all types of data that could potentially be useful, allowing users to apply Kibana filters later based on their needs. However, I understand this approach might lead to unnecessary index space consumption for users who are not interested in viewing resolved vulnerabilities.

сс @nick-alayil

after talking with @nick-alayil we think the best way forward is to make it configurable with OPEN being the default to keep the existing behaviour. Thanks for flagging it @efd6 !

@mohitjha-elastic Please add a manifest entry to allow this to be configurable.

@maxcold What kind of configuration would you prefer? The story around this kind of option is not a happy one; we either have a set of four booleans which do not show obvious grouping in the UI, 2^4 menu options, or multi-text (which allows typo-based misconfiguration) — or YAML. None of the available options are good.

My $0.02. Can we've a simple toggle to control this configuration?

Default (toggle OFF): Active vulnerabilities only

Sends only "OPEN" status vulnerabilities

Covers majority of use cases since most teams primarily care about actionable items

Simple, obvious, can't be misconfigured

Toggle ON: All vulnerability statuses

Includes RESOLVED, OPEN, REJECTED, IN_PROGRESS

For users who want comprehensive data for reporting/analytics

Still just one boolean setting. Impossible to mess up

That would work for me.

Thanks! Added a toggle option to control this configuration-

maxcold · 2025-07-30T15:11:20Z

+              state.?include_all_vulnerability.orValue(false) ?
+                ["RESOLVED", "OPEN", "REJECTED", "IN_PROGRESS"]
+              :
+                ["OPEN"]


btw I didn't find any docs in the Wiz partner portal that says that by default it queries only OPEN vulnerabilities. What concerns me is that we are changing the behaviour, as the query didn't have any status filter before, and we assumed that by default it filtered in only OPEN vulnerabilities. Do we know that for sure?

@mohitjha-elastic

I agree. This should not set the parameter in the case that the option is not selected.

I would suggest instead of using a boolean here, use

{{#if include_all_vulnerability}} want_status: - RESOLVED - OPEN - REJECTED - IN_PROGRESS {{/if}}

in the state definition. And then here

?"status": state.?want_status,

Thanks @efd6 @maxcold
The suggestions have been implemented.

maxcold

the logic in general looks good, but I'm not very good with CEL to check the exact implementation

efd6

Nit only. Othewise LGTM (waiting for opinion).

efd6 · 2025-08-04T03:25:39Z

+        title: Include All Vulnerability Statuses
+        description: >-
+          Enable this toggle to fetch all types of vulnerabilities, including those with statuses RESOLVED, OPEN, REJECTED, and IN_PROGRESS.
+          By default, only active vulnerabilities with the OPEN status are retrieved.


I would leave this as "By default, the API's default filter is used." This protects us from future changes in API behaviour.

/cc @maxcold for opinion.

I agree with the suggestion, as the documentation does not explicitly mention that only open vulnerabilities are fetched by default.

yes, let's not make guesses and have it as By default, the API's default filter is used. , thanks for checking!

elasticmachine · 2025-08-04T10:06:15Z

💚 Build Succeeded

Buildkite Build
Commit: a7652fc

History

💚 Build #29408 succeeded efc3134
💚 Build #29300 succeeded bc279a8
💚 Build #28963 succeeded 2d78339

cc @mohitjha-elastic

elastic-sonarqube · 2025-08-04T10:06:20Z

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

efd6

Will wait for @maxcold or @nick-alayil to comment on the documentation before merge.

elastic-vault-github-plugin-prod · 2025-08-06T02:30:26Z

Package wiz - 3.7.0 containing this change is available at https://epr.elastic.co/package/wiz/3.7.0/

…4664) This change introduces filters to the vulnerability dataset, allowing retrieval of all types of vulnerabilities. It enhances the dataset's flexibility by ensuring comprehensive coverage across different vulnerability categories.

Add filters to retrieve all types of vulnerabilities in the vulnerabi…

7fc7a48

…lity dataset

mohitjha-elastic self-assigned this Jul 23, 2025

mohitjha-elastic requested a review from a team as a code owner July 23, 2025 07:24

Update changelog entry

2d78339

efd6 reviewed Jul 28, 2025

View reviewed changes

mohitjha-elastic added 2 commits July 30, 2025 14:36

Add toggle to fetch all kinds of vulnerability.

3366907

Update changelog description.

bc279a8

mohitjha-elastic requested a review from efd6 July 30, 2025 09:11

maxcold reviewed Jul 30, 2025

View reviewed changes

Update status filter condition in vulnerability data stream.

efc3134

mohitjha-elastic requested a review from maxcold August 1, 2025 09:57

maxcold approved these changes Aug 1, 2025

View reviewed changes

efd6 reviewed Aug 4, 2025

View reviewed changes

Update description of include_all_vulnerability toggle in manifest.

a7652fc

efd6 approved these changes Aug 5, 2025

View reviewed changes

efd6 merged commit f0e9453 into elastic:main Aug 6, 2025
9 checks passed

Navigation Menu

Uh oh!

[wiz] Add Filters to Retrieve all Types of Vulnerabilities - #14664

[wiz] Add Filters to Retrieve all Types of Vulnerabilities#14664
efd6 merged 6 commits into
elastic:mainfrom
mohitjha-elastic:wiz-3.7.0

mohitjha-elastic commented Jul 23, 2025 •

edited by efd6

Loading

elasticmachine commented Jul 23, 2025

elastic-vault-github-plugin-prod Bot commented Jul 23, 2025

efd6 Jul 28, 2025

mohitjha-elastic Jul 28, 2025

maxcold Jul 28, 2025

maxcold Jul 28, 2025

efd6 Jul 28, 2025 •

edited

Loading

nick-alayil Jul 29, 2025

efd6 Jul 29, 2025

mohitjha-elastic Jul 30, 2025

maxcold Jul 30, 2025

maxcold Jul 31, 2025

efd6 Jul 31, 2025 •

edited

Loading

mohitjha-elastic Aug 1, 2025

maxcold left a comment

efd6 left a comment

efd6 Aug 4, 2025

mohitjha-elastic Aug 4, 2025

maxcold Aug 5, 2025

elasticmachine commented Aug 4, 2025

elastic-sonarqube Bot commented Aug 4, 2025

efd6 left a comment

Uh oh!

elastic-vault-github-plugin-prod Bot commented Aug 6, 2025

Labels

5 participants

Uh oh!

Conversation

mohitjha-elastic commented Jul 23, 2025 • edited by efd6 Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Proposed commit message

Checklist

How to test this PR locally

Related Issue

elasticmachine commented Jul 23, 2025

elastic-vault-github-plugin-prod Bot commented Jul 23, 2025

🚀 Benchmarks report

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

efd6 Jul 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

efd6 Jul 31, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Choose a reason for hiding this comment

maxcold left a comment

Choose a reason for hiding this comment

efd6 left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

elasticmachine commented Aug 4, 2025

💚 Build Succeeded

History

elastic-sonarqube Bot commented Aug 4, 2025

Quality Gate passed

efd6 left a comment

Choose a reason for hiding this comment

Uh oh!

elastic-vault-github-plugin-prod Bot commented Aug 6, 2025

Labels

5 participants

mohitjha-elastic commented Jul 23, 2025 •

edited by efd6

Loading

efd6 Jul 28, 2025 •

edited

Loading

efd6 Jul 31, 2025 •

edited

Loading