Full Report
Enhance your application security posture with Wiz Code's integration of 3rd-party SAST scanners and cloud context for faster risk prioritization and remediation.
Analysis Summary
# Tool/Technique: Wiz Integration (WIN) Platform / Wiz Code
## Overview
The Wiz Integration (WIN) Platform, featuring Wiz Code, is an open integration ecosystem designed to unify findings from external application security tools (like SAST and DAST) with cloud and runtime security insights managed by the Wiz Security Graph. Its primary purpose is to provide code-to-cloud visibility, enabling security teams to prioritize and accelerate remediation of critical issues regardless of their origin.
## Technical Details
- Type: Framework / Platform Extension (Focused on ASPM integration)
- Platform: Cloud environments, Developer toolchains (Code Repositories, CI/CD)
- Capabilities: Ingestion and correlation of third-party security findings; Unified policy enforcement; Code repository scanning; Infrastructure-as-Code (IaC) scanning; Secrets detection; Sensitive data scanning.
- First Seen: Not explicitly stated, but context suggests a recent expansion of the Wiz platform capabilities.
## MITRE ATT&CK Mapping
This tool/framework is designed for defense and visibility, not exploitation. Its capabilities map to defensive, detection, and response tactics:
- **TA0005 - Defense Evasion** (Indirectly, by detecting weaknesses that facilitate evasion)
- T1562.006 - Impair Defenses: Impair Security Software (If integrated scanning reveals weaknesses allowing this)
- **TA0011 - Collection** (Indirectly, by scanning for collected data)
- T1530 - Data from Information Repositories (Scanning for sensitive data/secrets)
- **TA0006 - Credential Access** (Indirectly, via secrets detection)
- T1552.001 - Credentials in Files (Secrets detection)
- **TA0003 - Persistence** (Indirectly, by scanning IaC for persistent backdoor configurations)
- **TA0004 - Privilege Escalation** (Indirectly)
## Functionality
### Core Capabilities
- **Code-to-Cloud Correlation:** Extends Wiz Cloud visibility into code repositories, CI/CD pipelines, and developer identities via **Wiz Code**, linking findings from code artifacts to running cloud infrastructure via the **Wiz Security Graph**.
- **Third-Party Finding Ingestion (WIN):** Unifies SAST, DAST, and API security findings from external sources (e.g., Checkmarx) directly into the Wiz Security Graph, correlating them with cloud context.
- **Unified Policy Engine:** Enforces security policies (vulnerabilities, misconfigurations, secrets) consistently across the entire development lifecycle (code and cloud).
### Advanced Features
- **Risk Prioritization:** Contextualizes findings (e.g., CWE-1004) by linking them through version control to show the specific workloads affected and the full potential attack path.
- **CI/CD Integration:** Native integrations (e.g., with Harness, Buildkite) allow WizCLI scanning for IaC, secrets, and vulnerabilities directly within pipelines pre-deployment.
- **Remediation Orchestration:** Integrates with ticketing systems (Jira, ServiceNow, Linear) and ChatOps solutions (Slack, Teams) for automated assignment and streamlined developer remediation workflows.
## Indicators of Compromise
As a defensive/security solution, it does not generate typical malicious IoCs. If integrated improperly, potential indicators relate to its operational components:
- File Hashes: N/A (Software platform)
- File Names: WizCLI components, Wiz Agent artifacts (Context dependent)
- Registry Keys: N/A
- Network Indicators: Connections to Wiz cloud services or integrated partner endpoints (e.g., Checkmarx instances) may be observed during operation.
- Behavioral Indicators: Creation of unified security inventory data structures; API calls to VCS/CI/CD systems for scanning operations.
## Associated Threat Actors
This is a commercial security solution applied by defenders; it is not known to be used maliciously by threat actors.
## Detection Methods
Detection methods revolve around monitoring the platform's operational activity or detecting the vulnerabilities it aims to find:
- Signature-based detection: Not applicable for scanning logic, but applicable for detecting vulnerabilities found by the integrated scanners (e.g., specific malware signatures in SCA findings).
- Behavioral detection: Monitoring for unauthorized access or excessive scanning activity related to the Wiz platform's credentials within VCS or cloud environments.
- YARA rules: Not explicitly provided, but YARA rules would be used by the integrated scanning tools (like Wiz Code built-in scanners) to detect secrets or sensitive data patterns.
## Mitigation Strategies
Mitigation focuses on proper deployment and leveraging the context provided:
- **Leverage Context:** Utilize the prioritized, context-rich view to focus remediation efforts on cloud-impacting code issues first.
- **Integrate Exhaustively:** Ensure all existing AppSec tools (SAST, DAST) are integrated via WIN for a unified posture.
- **Policy Enforcement:** Configure and enforce consistent security policies across the platform using the unified policy engine during CI/CD workflows.
- **Secure Access:** Ensure the service accounts/identities used by Wiz Code for connecting to repositories and cloud environments have strictly scoped, least-privilege access.
## Related Tools/Techniques
- SAST (Static Application Security Testing)
- DAST (Dynamic Application Security Testing)
- SCA (Software Composition Analysis)
- API Security Scanning Tools (e.g., Checkmarx)
- Cloud Security Posture Management (CSPM) tools
- ASPM (Application Security Posture Management - the category Wiz Code addresses)