Wiz Scanner Parser

The Wiz parser for DefectDojo supports imports from both Wiz Scanner Standard and SCA (Software Composition Analysis) .csv output from Wiz.io. This document details the parsing of both formats into DefectDojo field mappings, unmapped fields, and location of each field’s parsing code for easier troubleshooting and analysis.

⚠️ DefectDojo Pro Users can also automatically create Findings directly from Wiz using the Wiz Connector. See our Connectors documentation for more details.

Supported File Types

The Wiz parser accepts CSV file format. There are two primary formats supported:

1. Standard Format - Issues exports with “Title” field (processed by WizParserByTitle class)
2. SCA Format - Vulnerability exports with “Name” and “DetailedName” fields (processed by WizParserByDetailedName class)

To generate these files, export the findings from the Wiz platform by:

• Standard Format: Select “Export to CSV” option from the Issues view in the Wiz.io platform
• SCA Format: Select “Export to CSV” option from the Vulnerability view in the Wiz.io platform

Sample Scan Data

Sample Wiz Scanner scans can be found in the sample scan data folder.

Default Deduplication Hashcode Fields

By default, DefectDojo identifies duplicate Findings using these hashcode fields:

• title
• description
• severity

Mapped Fields Dictionary

Standard Format CSV

This format applies the WizParserByTitle parser class.

Total Fields in Standard Format CSV

• Total data fields: 32
• Total data fields parsed: 32
• Total data fields NOT parsed: 0

Standard Format Field Mapping Details

Additional Finding Field Settings (Standard Format)

SCA Format

This format applies the WizParserByDetailedName parser class.

Total Fields in SCA CSV

• Total data fields: 41
• Total data fields parsed: 36
• Total data fields NOT parsed: 5

SCA Format Field Mapping Details

Additional Finding Field Settings (SCA Format)

Special Processing Notes

Date Processing

• Parser uses function parse_wiz_datetime() to handle different date formats from Wiz
• Handles both ISO8601 and custom Wiz timestamp formats

Status Conversion

• Both parser formats use WizcliParsers.convert_status() function to determine finding status (active, mitigated, etc.)
• Standard format - if a finding is mitigated, the Resolved Time is used as the mitigated timestamp

Description Construction

• Most CSV fields maintain field name as a prefix when added to the Finding description
• Description generated by iterating through predefined list of fields and adding data if present

Title Format

• Standard format: Used directly from the “Title” field
• SCA format: Combines package name (DetailedName) and vulnerability ID (Name) in format “{package_name}: {vulnerability_id}”

Mitigation Construction

• Standard format: Primary source is “Remediation Recommendation” field with optional “Resolution” field
• SCA format: Combines “Remediation”, “LocationPath”, and “FixedVersion” fields

Deduplication

• Both formats use the respective ID field as the unique_id_from_tool for deduplication

Tags Handling (SCA Format)

• “Tags” field is parsed from a JSON string format into a list of tag strings in format “key: value”

Source Code

Source code for the Wiz parser can be found on GitHub.