[wiz] Various minor improvements by chrisberkhout · Pull Request #19203 · elastic/integrations

chrisberkhout · 2026-05-26T10:31:41Z

Proposed commit message

[wiz] Various minor improvements

- Fix the logo file.

  It was raster data with formatting that wasn't strictly correct. Now
  it's vector data.

- Set the right User-Agent header.

  A workaround for https://github.com/elastic/beats/issues/50867.

- Don't use the demo env URL as a default value.

- Make `cloud_configuration_finding_full_posture`'s 24h interval an
  advanced options.

  That may be helpful for debugging or workarounds.

- Use `updatedAt` rather than `analyzedAt` in queries for cloud
  configuration finding data.

  The `analyzedAt` field remains and is mapped in the same way, but the
  `updatedAt` field is added and that's what's used for query filtering,
  as recommended by Wiz

- Tolerate URLs with a `/graphql` or `/graphql/` path.

  We expect just the base: `https://api.somedc.app.wiz.io`. Wiz provides
  an "API Endpoint" with the path:
  `https://api.somedc.app.wiz.io/graphql`, so that should work too.

- Set a static request rate of 0.5 rps per data stream, increase
  retries.

  Testing shows that 5 rps should be okay (4 rps is fine for 10s, 8 rps
  occasionally returns 429). We have 5 data streams using the GraphQL
  API.  Four run frequently (by default every 5 mins), one is a daily
  sync.
    
  Setting a request rate limit of 0.5 rps for each data stream means we
  should never exceed 2.5 rps in total, and never reach the rate limit.
  
  The only feedback from the server about the rate limit is that it
  responds with 429, with retry-after / reset information, once the
  limit has been exceeded. If a 429 response is received, the input will
  retry the request, respecting the retry-after period.
  
  We set a conservative static rate because the different data streams
  are unable to coordinate on the client side, and they receive no
  request budget feedback from the server side until its too late.
  
  We don't expect retries, but since they are possible due to rate
  limiting rather than just request or server errors, the maximum number
  of retry attempts is raised from 5 to 10.

- Make Token URL a non-advanced setting.

  Since apparently it can vary, and will be provided by Wiz along with
  the API Endpoint and credentials.

- Tell the user the interval setting 'must be 5m or longer'.

- Add a screenshot of the policy editor UI.

  This was specifically requested by Wiz.

- README: Clarify information about transforms and their outputs.

- Dashboards: Use panel-level filters, fix the nav/overview panel
  formatting, and some other minor tidying.

Note to reviewers

This is best read commit-by-commit.

It's batch of updates based on discussion with Wiz and a general review of the current state.

I'm open to breaking it into multiple PRs, if you think that's worthwhile.

Checklist

I have reviewed tips for building integrations and this pull request is aligned with them.
I have verified that all data streams collect metrics or logs.
I have added an entry to my package's changelog.yml file.
I have verified that Kibana version constraints are current according to guidelines.
I have verified that any added dashboard complies with Kibana's Dashboard good practices

The logo was not showing in Firefox because it had embedded base64 encoded PNG data that was formatted with whitespace that isn't strictly allowed. Replaced with an actual vector version of the logo.

This is a workaround for elastic/beats#50867.

…able as an advanced options. May be helpful for debugging or workarounds.

infra-vault-gh-plugin-prod · 2026-05-26T10:31:47Z

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

github-actions · 2026-05-26T10:33:52Z

✅ Vale Linting Results

No issues found on modified lines!

The Vale linter checks documentation changes against the Elastic Docs style guide.

To use Vale locally or report issues, refer to Elastic style guide for Vale.

…on finding data. The `analyzedAt` field remains and is mapped in the same way, but the `updatedAt` field is added and that's what's used for query filtering, as recommended by Wiz.

elastic-vault-github-plugin-prod · 2026-05-26T13:00:32Z

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

We expect just the base: `https://api.somedc.app.wiz.io`. Wiz provides an "API Endpoint" with the path: `https://api.somedc.app.wiz.io/graphql`, so that should work too. Better URL cleaning.

Testing shows that 5 rps should be okay (4 rps is fine for 10s, 8 rps occasionally returns 429). We have 5 data streams using the GraphQL API. Four run frequently (by default every 5 mins), one is a daily sync. Setting a request rate limit of 0.5 rps for each data stream means we should never exceed 2.5 rps in total, and never reach the rate limit. The only feedback from the server about the rate limit is that it responds with 429, with retry-after / reset information, once the limit has been exceeded. If a 429 response is received, the input will retry the request, respecting the retry-after period. We set a conservative static rate because the different data streams are unable to coordinate on the client side, and they receive no request budget feedback from the server side until its too late. We don't expect retries, but since they are possible due to rate limiting rather than just request or server errors, the maximum number of retry attempts is raised from 5 to 10.

Since apparently it can vary, and will be provided by Wiz along with the API Endpoint and credentials.

This was specifically requested by Wiz.

… data that has a transform.

…tion for data that has a transform." This reverts commit 166ea075774515ed3bade16d678318cedf9529b9.

kcreddy

LGTM, thanks!

mohitjha-elastic

Thanks!

elasticmachine · 2026-05-27T10:31:11Z

💚 Build Succeeded

Buildkite Build
Commit: 13fa74f

History

💚 Build #43601 succeeded 7dd4727
💚 Build #43532 succeeded d36b682
💔 Build #43511 failed 4bd73ee

cc @chrisberkhout

elastic-vault-github-plugin-prod · 2026-05-27T12:12:23Z

Package wiz - 4.3.0 containing this change is available at https://epr.elastic.co/package/wiz/4.3.0/

chrisberkhout added 4 commits May 22, 2026 10:34

Fix logo file.

8bcf3b7

The logo was not showing in Firefox because it had embedded base64 encoded PNG data that was formatted with whitespace that isn't strictly allowed. Replaced with an actual vector version of the logo.

Set the right User-Agent header.

33acc29

This is a workaround for elastic/beats#50867.

Don't use the demo env URL as a default value.

df492e1

Make cloud_configuration_finding_full_posture's 24h interval configur…

621ef53

…able as an advanced options. May be helpful for debugging or workarounds.

chrisberkhout self-assigned this May 26, 2026

chrisberkhout requested review from a team as code owners May 26, 2026 10:31

chrisberkhout added enhancement New feature or request bugfix Pull request that fixes a bug issue Integration:wiz Wiz Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations] labels May 26, 2026

andrewkroh added dashboard Relates to a Kibana dashboard bug, enhancement, or modification. documentation Improvements or additions to documentation. Applied to PRs that modify *.md files. labels May 26, 2026

Use updatedAt rather than analyzedAt in queries for cloud configurati…

7bfabfe

…on finding data. The `analyzedAt` field remains and is mapped in the same way, but the `updatedAt` field is added and that's what's used for query filtering, as recommended by Wiz.

chrisberkhout force-pushed the wiz-tidy-up branch 2 times, most recently from 90427a2 to d36b682 Compare May 26, 2026 12:35

kcreddy reviewed May 26, 2026

View reviewed changes

Comment thread packages/wiz/data_stream/audit/agent/stream/cel.yml.hbs Outdated

Comment thread packages/wiz/data_stream/cloud_configuration_finding/manifest.yml

mohitjha-elastic reviewed May 27, 2026

View reviewed changes

Comment thread packages/wiz/changelog.yml Outdated

mohitjha-elastic reviewed May 27, 2026

View reviewed changes

Comment thread packages/wiz/data_stream/cloud_configuration_finding/elasticsearch/ingest_pipeline/default.yml

mohitjha-elastic requested changes May 27, 2026

View reviewed changes

chrisberkhout force-pushed the wiz-tidy-up branch 2 times, most recently from 56395f4 to 7dd4727 Compare May 27, 2026 09:24

chrisberkhout requested a review from mohitjha-elastic May 27, 2026 09:31

chrisberkhout added 4 commits May 27, 2026 12:06

Tolerate URLs with a /graphql path (or /graphql/).

14f0d2e

We expect just the base: `https://api.somedc.app.wiz.io`. Wiz provides an "API Endpoint" with the path: `https://api.somedc.app.wiz.io/graphql`, so that should work too. Better URL cleaning.

Make Token URL a non-advanced setting.

8a90238

Since apparently it can vary, and will be provided by Wiz along with the API Endpoint and credentials.

Tell the user the interval setting 'must be 5m or longer'.

d91824f

chrisberkhout added 12 commits May 27, 2026 12:06

Add a screenshot of the 'config UI' (policy editor UI).

78e0820

This was specifically requested by Wiz.

README: Clearer information about transforms and using their outputs.

45e619e

Add a labels.is_transform_source field for source and destination for…

5f879f8

… data that has a transform.

Revert "Add a labels.is_transform_source field for source and destina…

960a680

…tion for data that has a transform." This reverts commit 166ea075774515ed3bade16d678318cedf9529b9.

Dashboards: no-op export.

fc8189b

Dashboards: use panel-level filters.

75246f0

Dashboards: Remove duplicated search reference.

62374d2

Dashboards: Remove redundant tag references.

7d72a4d

Dashboards: Remove Defend dashboard description for consistency, etc.

3eac3da

Dashboards: Fix nav/overview panel formatting.

fcc5d43

Version bump, changelog entry.

f4ab859

Fix typo in manifest title.

13fa74f

chrisberkhout force-pushed the wiz-tidy-up branch from 7dd4727 to 13fa74f Compare May 27, 2026 10:06

kcreddy approved these changes May 27, 2026

View reviewed changes

mohitjha-elastic approved these changes May 27, 2026

View reviewed changes

chrisberkhout merged commit 110d0b0 into elastic:main May 27, 2026
13 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[wiz] Various minor improvements#19203

[wiz] Various minor improvements#19203
chrisberkhout merged 21 commits into
elastic:mainfrom
chrisberkhout:wiz-tidy-up

chrisberkhout commented May 26, 2026 •

edited

Loading

Uh oh!

infra-vault-gh-plugin-prod Bot commented May 26, 2026

Uh oh!

github-actions Bot commented May 26, 2026 •

edited

Loading

Uh oh!

elastic-vault-github-plugin-prod Bot commented May 26, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

kcreddy left a comment

Uh oh!

mohitjha-elastic left a comment

Uh oh!

elasticmachine commented May 27, 2026

Uh oh!

Uh oh!

elastic-vault-github-plugin-prod Bot commented May 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

chrisberkhout commented May 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Proposed commit message

Note to reviewers

Checklist

Uh oh!

infra-vault-gh-plugin-prod Bot commented May 26, 2026

Uh oh!

github-actions Bot commented May 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Vale Linting Results

Uh oh!

elastic-vault-github-plugin-prod Bot commented May 26, 2026

🚀 Benchmarks report

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

kcreddy left a comment

Choose a reason for hiding this comment

Uh oh!

mohitjha-elastic left a comment

Choose a reason for hiding this comment

Uh oh!

elasticmachine commented May 27, 2026

💚 Build Succeeded

History

Uh oh!

Uh oh!

elastic-vault-github-plugin-prod Bot commented May 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

chrisberkhout commented May 26, 2026 •

edited

Loading

github-actions Bot commented May 26, 2026 •

edited

Loading