Wiz

{
    "@timestamp": "2023-07-21T07:07:21.105Z",
    "agent": {
        "ephemeral_id": "5c3096ee-b490-4b19-a848-bfed150c1bca",
        "id": "927b2eff-4394-4486-ab77-d6bfa7c529cf",
        "name": "docker-fleet-agent",
        "type": "filebeat",
        "version": "8.10.1"
    },
    "data_stream": {
        "dataset": "wiz.audit",
        "namespace": "ep",
        "type": "logs"
    },
    "ecs": {
        "version": "8.11.0"
    },
    "elastic_agent": {
        "id": "927b2eff-4394-4486-ab77-d6bfa7c529cf",
        "snapshot": false,
        "version": "8.10.1"
    },
    "event": {
        "action": "login",
        "agent_id_status": "verified",
        "category": [
            "authentication"
        ],
        "dataset": "wiz.audit",
        "id": "hhd8ab9c-f1bf-4a80-a1e1-13bc8769caf4",
        "ingested": "2023-10-03T10:35:48Z",
        "kind": "event",
        "original": "{\"action\":\"Login\",\"actionParameters\":{\"clientID\":\"afsdafasmdgj5c\",\"groups\":null,\"name\":\"example\",\"products\":[\"*\"],\"role\":\"\",\"scopes\":[\"read:issues\",\"read:reports\",\"read:vulnerabilities\",\"update:reports\",\"create:reports\",\"admin:audit\"],\"userEmail\":\"\",\"userID\":\"afsafasdghbhdfg5t35fdgs\",\"userpoolID\":\"us-east-2_GQ3gwvxsQ\"},\"id\":\"hhd8ab9c-f1bf-4a80-a1e1-13bc8769caf4\",\"requestId\":\"hhd8ab9c-f1bf-4a80-a1e1-13bc8769caf4\",\"serviceAccount\":{\"id\":\"mlipebtwsndhxdmnzdwrxzmiolvzt6topjvv4nugzctcsyarazrhg\",\"name\":\"elastic\"},\"sourceIP\":null,\"status\":\"SUCCESS\",\"timestamp\":\"2023-07-21T07:07:21.105685Z\",\"user\":null,\"userAgent\":null}",
        "outcome": "success",
        "type": [
            "info"
        ]
    },
    "http": {
        "request": {
            "id": "hhd8ab9c-f1bf-4a80-a1e1-13bc8769caf4"
        }
    },
    "input": {
        "type": "cel"
    },
    "related": {
        "user": [
            "afsafasdghbhdfg5t35fdgs",
            "us-east-2_GQ3gwvxsQ"
        ]
    },
    "tags": [
        "preserve_original_event",
        "preserve_duplicate_custom_fields",
        "forwarded",
        "wiz-audit"
    ],
    "wiz": {
        "audit": {
            "action": "Login",
            "action_parameters": {
                "client_id": "afsdafasmdgj5c",
                "name": "example",
                "products": [
                    "*"
                ],
                "scopes": [
                    "read:issues",
                    "read:reports",
                    "read:vulnerabilities",
                    "update:reports",
                    "create:reports",
                    "admin:audit"
                ],
                "user": {
                    "id": "afsafasdghbhdfg5t35fdgs"
                },
                "userpool_id": "us-east-2_GQ3gwvxsQ"
            },
            "id": "hhd8ab9c-f1bf-4a80-a1e1-13bc8769caf4",
            "request_id": "hhd8ab9c-f1bf-4a80-a1e1-13bc8769caf4",
            "service_account": {
                "id": "mlipebtwsndhxdmnzdwrxzmiolvzt6topjvv4nugzctcsyarazrhg",
                "name": "elastic"
            },
            "status": "SUCCESS",
            "timestamp": "2023-07-21T07:07:21.105Z"
        }
    }
}

{
    "@timestamp": "2023-06-12T11:38:07.900Z",
    "cloud": {
        "account": {
            "id": "cfd132be-3bc7-4f86-8efd-ed53ae498fec",
            "name": "Wiz - DEV Outpost"
        },
        "provider": "azure"
    },
    "ecs": {
        "version": "8.11.0"
    },
    "event": {
        "category": [
            "configuration"
        ],
        "created": "2023-06-12T11:38:07.900Z",
        "id": "bdeba988-f41b-55e6-9b99-96b8d3dc67d4",
        "kind": "state",
        "original": "{\"id\":\"bdeba988-f41b-55e6-9b99-96b8d3dc67d4\",\"targetExternalId\":\"k8s/pod/da99fd668e64c2def251b1d48b7b69ad3129638787a0f9144a993fe30fd4554f/default/cluster-autoscaler-azure-cluster-autoscaler-8bc677d64-z2qfx\",\"targetObjectProviderUniqueId\":\"cd971d74-92db-495c-8244-82da9a988fd0\",\"firstSeenAt\":\"2023-06-12T11:38:07.900129Z\",\"analyzedAt\":\"2023-06-12T11:38:07.900129Z\",\"severity\":\"LOW\",\"result\":\"FAIL\",\"status\":\"OPEN\",\"remediation\":\"Follow the step below to ensure that each [Pod](https://kubernetes.io/docs/concepts/workloads/pods) should runs containers with allowed additional capabilities: \\r\\n* The following capabilities are not allowed : {{removeUnnecessaryCapabilities}} .  \\r\\n* `securityContext.capabilities.drop` key is set to `ALL`. \\r\\n\",\"resource\":{\"id\":\"0e814bb7-29e8-5c15-be9c-8da42c67ee99\",\"providerId\":\"provider-id-0e814bb7-29e8-5c15-be9c-8da42c67ee99\",\"name\":\"cluster-autoscaler-azure-cluster-autoscaler-8bc677d64-z2qfx\",\"nativeType\":\"Pod\",\"type\":\"POD\",\"region\":null,\"subscription\":{\"id\":\"a3a3cc43-1dfd-50f1-882e-692840d4a891\",\"name\":\"Wiz - DEV Outpost\",\"externalId\":\"cfd132be-3bc7-4f86-8efd-ed53ae498fec\",\"cloudProvider\":\"Azure\"},\"projects\":null,\"tags\":[{\"key\":\"pod-template-hash\",\"value\":\"8bc677d64\"},{\"key\":\"app.kubernetes.io/name\",\"value\":\"azure-cluster-autoscaler\"},{\"key\":\"app.kubernetes.io/instance\",\"value\":\"cluster-autoscaler\"}]},\"rule\":{\"id\":\"73553de7-f2ad-4ffb-b425-c69815033530\",\"shortId\":\"Pod-32\",\"graphId\":\"99ffeef7-75df-5c88-9265-5ab50ffbc2b9\",\"name\":\"Pod should run containers with authorized additional capabilities (PSS Restricted)\",\"description\":\"This rule is part of the Kubernetes [Pod Security Standards (PSS) restricted policies](https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted).   \\nThis rule checks whether the pod is running containers with authorized additional capabilities.     \\nThis rule fails if the `securityContext.capabilities.add` contains any capability beyond `NET_BIND_SERVICE` and if `securityContext.capabilities.drop` is not set to `ALL`.  \\nBy default, if the `securityContext.capabilities.add` key is not set, the pod will not run with additional capabilities, and the rule will pass.   \\nLinux capabilities allow granting certain privileges to a container without granting any unnecessary ones intended for the root user.\",\"remediationInstructions\":\"Follow the step below to ensure that each [Pod](https://kubernetes.io/docs/concepts/workloads/pods) should runs containers with allowed additional capabilities: \\r\\n* The following capabilities are not allowed : {{removeUnnecessaryCapabilities}} .  \\r\\n* `securityContext.capabilities.drop` key is set to `ALL`. \\r\\n\",\"functionAsControl\":false},\"securitySubCategories\":[{\"id\":\"wsct-id-5206\",\"title\":\"Container Security\",\"category\":{\"id\":\"wct-id-423\",\"name\":\"9 Container Security\",\"framework\":{\"id\":\"wf-id-1\",\"name\":\"Wiz\"}}},{\"id\":\"wsct-id-8176\",\"title\":\"5.1 Containers should not run with additional capabilities\",\"category\":{\"id\":\"wct-id-1295\",\"name\":\"5 Capabilities\",\"framework\":{\"id\":\"wf-id-57\",\"name\":\"Kubernetes Pod Security Standards (Restricted)\"}}},{\"id\":\"wsct-id-8344\",\"title\":\"Cluster misconfiguration\",\"category\":{\"id\":\"wct-id-1169\",\"name\":\"2 Container & Kubernetes Security\",\"framework\":{\"id\":\"wf-id-53\",\"name\":\"Wiz Detailed\"}}}]}",
        "outcome": "failure",
        "type": [
            "info"
        ]
    },
    "message": "This rule is part of the Kubernetes [Pod Security Standards (PSS) restricted policies](https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted).   \nThis rule checks whether the pod is running containers with authorized additional capabilities.     \nThis rule fails if the `securityContext.capabilities.add` contains any capability beyond `NET_BIND_SERVICE` and if `securityContext.capabilities.drop` is not set to `ALL`.  \nBy default, if the `securityContext.capabilities.add` key is not set, the pod will not run with additional capabilities, and the rule will pass.   \nLinux capabilities allow granting certain privileges to a container without granting any unnecessary ones intended for the root user.",
    "observer": {
        "vendor": "Wiz"
    },
    "resource": {
        "id": "provider-id-0e814bb7-29e8-5c15-be9c-8da42c67ee99",
        "name": "cluster-autoscaler-azure-cluster-autoscaler-8bc677d64-z2qfx",
        "sub_type": "Pod",
        "type": "POD"
    },
    "result": {
        "evaluation": "FAILED"
    },
    "rule": {
        "description": "This rule is part of the Kubernetes [Pod Security Standards (PSS) restricted policies](https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted).   \nThis rule checks whether the pod is running containers with authorized additional capabilities.     \nThis rule fails if the `securityContext.capabilities.add` contains any capability beyond `NET_BIND_SERVICE` and if `securityContext.capabilities.drop` is not set to `ALL`.  \nBy default, if the `securityContext.capabilities.add` key is not set, the pod will not run with additional capabilities, and the rule will pass.   \nLinux capabilities allow granting certain privileges to a container without granting any unnecessary ones intended for the root user.",
        "id": "Pod-32",
        "name": "Pod should run containers with authorized additional capabilities (PSS Restricted)",
        "remediation": "Follow the step below to ensure that each [Pod](https://kubernetes.io/docs/concepts/workloads/pods) should runs containers with allowed additional capabilities: \r\n* The following capabilities are not allowed : {{removeUnnecessaryCapabilities}} .  \r\n* `securityContext.capabilities.drop` key is set to `ALL`. \r\n",
        "uuid": "73553de7-f2ad-4ffb-b425-c69815033530"
    },
    "tags": [
        "preserve_original_event",
        "preserve_duplicate_custom_fields"
    ],
    "wiz": {
        "cloud_configuration_finding": {
            "analyzed_at": "2023-06-12T11:38:07.900Z",
            "id": "bdeba988-f41b-55e6-9b99-96b8d3dc67d4",
            "resource": {
                "id": "0e814bb7-29e8-5c15-be9c-8da42c67ee99",
                "name": "cluster-autoscaler-azure-cluster-autoscaler-8bc677d64-z2qfx",
                "native_type": "Pod",
                "provider_id": "provider-id-0e814bb7-29e8-5c15-be9c-8da42c67ee99",
                "subscription": {
                    "cloud_provider": "Azure",
                    "external_id": "cfd132be-3bc7-4f86-8efd-ed53ae498fec",
                    "name": "Wiz - DEV Outpost"
                },
                "type": "POD"
            },
            "result": "FAIL",
            "rule": {
                "description": "This rule is part of the Kubernetes [Pod Security Standards (PSS) restricted policies](https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted).   \nThis rule checks whether the pod is running containers with authorized additional capabilities.     \nThis rule fails if the `securityContext.capabilities.add` contains any capability beyond `NET_BIND_SERVICE` and if `securityContext.capabilities.drop` is not set to `ALL`.  \nBy default, if the `securityContext.capabilities.add` key is not set, the pod will not run with additional capabilities, and the rule will pass.   \nLinux capabilities allow granting certain privileges to a container without granting any unnecessary ones intended for the root user.",
                "id": "73553de7-f2ad-4ffb-b425-c69815033530",
                "name": "Pod should run containers with authorized additional capabilities (PSS Restricted)",
                "remediation_instructions": "Follow the step below to ensure that each [Pod](https://kubernetes.io/docs/concepts/workloads/pods) should runs containers with allowed additional capabilities: \r\n* The following capabilities are not allowed : {{removeUnnecessaryCapabilities}} .  \r\n* `securityContext.capabilities.drop` key is set to `ALL`. \r\n",
                "short_id": "Pod-32"
            }
        }
    }
}

{
    "@timestamp": "2023-07-31T06:26:08.708Z",
    "agent": {
        "ephemeral_id": "e74ac4d2-8565-45ee-8c61-c66b6f3151bf",
        "id": "927b2eff-4394-4486-ab77-d6bfa7c529cf",
        "name": "docker-fleet-agent",
        "type": "filebeat",
        "version": "8.10.1"
    },
    "cloud": {
        "provider": "Kubernetes",
        "region": "us-01"
    },
    "data_stream": {
        "dataset": "wiz.issue",
        "namespace": "ep",
        "type": "logs"
    },
    "ecs": {
        "version": "8.11.0"
    },
    "elastic_agent": {
        "id": "927b2eff-4394-4486-ab77-d6bfa7c529cf",
        "snapshot": false,
        "version": "8.10.1"
    },
    "event": {
        "agent_id_status": "verified",
        "category": [
            "configuration"
        ],
        "created": "2023-08-23T07:56:09.903Z",
        "dataset": "wiz.issue",
        "id": "fff9cffd-64a7-412c-9535-cf837f4b0b40",
        "ingested": "2023-10-03T10:22:42Z",
        "kind": "event",
        "original": "{\"createdAt\":\"2023-08-23T07:56:09.903743Z\",\"dueAt\":\"2023-08-30T21:00:00Z\",\"entitySnapshot\":{\"cloudPlatform\":\"Kubernetes\",\"cloudProviderURL\":\"https://portal.az.com/#@sectest.on.com/resource//subscriptions/\",\"externalId\":\"k8s/clusterrole/aaa8e7ca2bf9bc85a75d5bbdd8ffd08d69f8852782a6341c3c3519sad45/system:aggregate-to-edit/12\",\"id\":\"e507d472-b7da-5f05-9b25-72a271336b14\",\"name\":\"system:aggregate-to-edit\",\"nativeType\":\"ClusterRole\",\"providerId\":\"k8s/clusterrole/aaa8e7ca2bf9bc85a75d5bbdd8ffd08d69f8852782a6341c3c3519bac0f24ae9/system:aggregate-to-edit/12\",\"region\":\"us-01\",\"resourceGroupExternalId\":\"/subscriptions/cfd132be-3bc7-4f86-8efd-ed53ae498fec/resourcegroups/test-selfmanaged-eastus\",\"status\":\"Active\",\"subscriptionExternalId\":\"998231069301\",\"subscriptionName\":\"demo-integrations\",\"subscriptionTags\":{},\"tags\":{\"kubernetes.io/bootstrapping\":\"rbac-defaults\",\"rbac.authorization.k8s.io/aggregate-to-edit\":\"true\"},\"type\":\"ACCESS_ROLE\"},\"id\":\"fff9cffd-64a7-412c-9535-cf837f4b0b40\",\"notes\":[{\"createdAt\":\"2023-08-23T07:56:09.903743Z\",\"serviceAccount\":{\"name\":\"rev-ke\"},\"text\":\"updated\",\"updatedAt\":\"2023-08-09T23:10:22.588721Z\"},{\"createdAt\":\"2023-08-09T23:08:49.918941Z\",\"serviceAccount\":{\"name\":\"rev-ke2\"},\"text\":\"updated\",\"updatedAt\":\"2023-08-09T23:10:22.591487Z\"}],\"projects\":[{\"businessUnit\":\"\",\"id\":\"83b76efe-a7b6-5762-8a53-8e8f59e68bd8\",\"name\":\"Project 2\",\"riskProfile\":{\"businessImpact\":\"MBI\"},\"slug\":\"project-2\"},{\"businessUnit\":\"Dev\",\"id\":\"af52828c-4eb1-5c4e-847c-ebc3a5ead531\",\"name\":\"project 4\",\"riskProfile\":{\"businessImpact\":\"MBI\"},\"slug\":\"project-4\"},{\"businessUnit\":\"Dev\",\"id\":\"d6ac50bb-aec0-52fc-80ab-bacd7b02f178\",\"name\":\"Project1\",\"riskProfile\":{\"businessImpact\":\"MBI\"},\"slug\":\"project1\"}],\"resolvedAt\":\"2023-08-09T23:10:22.588721Z\",\"serviceTickets\":[{\"externalId\":\"638361121bbfdd10f6c1cbf3604bcb7e\",\"name\":\"SIR0010002\",\"url\":\"https://ven05658.testing.com/nav_to.do?uri=%2Fsn_si_incident.do%3Fsys_id%3D6385248sdsae421\"}],\"severity\":\"INFORMATIONAL\",\"sourceRule\":{\"__typename\":\"Control\",\"controlDescription\":\"These EKS principals assume roles that provide bind, escalate and impersonate permissions. \\n\\nThe `bind` permission allows users to create bindings to roles with rights they do not already have. The `escalate` permission allows users effectively escalate their privileges. The `impersonate` permission allows users to impersonate and gain the rights of other users in the cluster. Running containers with these permissions has the potential to effectively allow privilege escalation to the cluster-admin level.\",\"id\":\"wc-id-1335\",\"name\":\"EKS principals assume roles that provide bind, escalate and impersonate permissions\",\"resolutionRecommendation\":\"To follow the principle of least privilege and minimize the risk of unauthorized access and data breaches, it is recommended not to grant `bind`, `escalate` or `impersonate` permissions.\",\"securitySubCategories\":[{\"category\":{\"framework\":{\"name\":\"CIS EKS 1.2.0\"},\"name\":\"4.1 RBAC and Service Accounts\"},\"title\":\"4.1.8 Limit use of the Bind, Impersonate and Escalate permissions in the Kubernetes cluster - Level 1 (Manual)\"},{\"category\":{\"framework\":{\"name\":\"Wiz for Risk Assessment\"},\"name\":\"Identity Management\"},\"title\":\"Privileged principal\"},{\"category\":{\"framework\":{\"name\":\"Wiz\"},\"name\":\"9 Container Security\"},\"title\":\"Container Security\"},{\"category\":{\"framework\":{\"name\":\"Wiz for Risk Assessment\"},\"name\":\"Container \\u0026 Kubernetes Security\"},\"title\":\"Cluster misconfiguration\"}]},\"status\":\"IN_PROGRESS\",\"statusChangedAt\":\"2023-07-31T06:26:08.708199Z\",\"updatedAt\":\"2023-08-14T06:06:18.331647Z\"}",
        "type": [
            "info"
        ]
    },
    "input": {
        "type": "cel"
    },
    "message": "These EKS principals assume roles that provide bind, escalate and impersonate permissions. \n\nThe `bind` permission allows users to create bindings to roles with rights they do not already have. The `escalate` permission allows users effectively escalate their privileges. The `impersonate` permission allows users to impersonate and gain the rights of other users in the cluster. Running containers with these permissions has the potential to effectively allow privilege escalation to the cluster-admin level.",
    "tags": [
        "preserve_original_event",
        "preserve_duplicate_custom_fields",
        "forwarded",
        "wiz-issue"
    ],
    "url": {
        "domain": "portal.az.com",
        "fragment": "@sectest.on.com/resource//subscriptions/",
        "original": "https://portal.az.com/#@sectest.on.com/resource//subscriptions/",
        "path": "/",
        "scheme": "https"
    },
    "wiz": {
        "issue": {
            "created_at": "2023-08-23T07:56:09.903Z",
            "due_at": "2023-08-30T21:00:00.000Z",
            "entity_snapshot": {
                "cloud": {
                    "platform": "Kubernetes",
                    "provider_url": "https://portal.az.com/#@sectest.on.com/resource//subscriptions/"
                },
                "external_id": "k8s/clusterrole/aaa8e7ca2bf9bc85a75d5bbdd8ffd08d69f8852782a6341c3c3519sad45/system:aggregate-to-edit/12",
                "id": "e507d472-b7da-5f05-9b25-72a271336b14",
                "name": "system:aggregate-to-edit",
                "native_type": "ClusterRole",
                "provider_id": "k8s/clusterrole/aaa8e7ca2bf9bc85a75d5bbdd8ffd08d69f8852782a6341c3c3519bac0f24ae9/system:aggregate-to-edit/12",
                "region": "us-01",
                "resource_group_external_id": "/subscriptions/cfd132be-3bc7-4f86-8efd-ed53ae498fec/resourcegroups/test-selfmanaged-eastus",
                "status": "Active",
                "subscription": {
                    "external_id": "998231069301",
                    "name": "demo-integrations"
                },
                "tags": {
                    "kubernetes.io/bootstrapping": "rbac-defaults",
                    "rbac.authorization.k8s.io/aggregate-to-edit": "true"
                },
                "type": "ACCESS_ROLE"
            },
            "id": "fff9cffd-64a7-412c-9535-cf837f4b0b40",
            "notes": [
                {
                    "created_at": "2023-08-23T07:56:09.903Z",
                    "service_account": {
                        "name": "rev-ke"
                    },
                    "text": "updated",
                    "updated_at": "2023-08-09T23:10:22.588Z"
                },
                {
                    "created_at": "2023-08-09T23:08:49.918Z",
                    "service_account": {
                        "name": "rev-ke2"
                    },
                    "text": "updated",
                    "updated_at": "2023-08-09T23:10:22.591Z"
                }
            ],
            "projects": [
                {
                    "id": "83b76efe-a7b6-5762-8a53-8e8f59e68bd8",
                    "name": "Project 2",
                    "risk_profile": {
                        "business_impact": "MBI"
                    },
                    "slug": "project-2"
                },
                {
                    "business_unit": "Dev",
                    "id": "af52828c-4eb1-5c4e-847c-ebc3a5ead531",
                    "name": "project 4",
                    "risk_profile": {
                        "business_impact": "MBI"
                    },
                    "slug": "project-4"
                },
                {
                    "business_unit": "Dev",
                    "id": "d6ac50bb-aec0-52fc-80ab-bacd7b02f178",
                    "name": "Project1",
                    "risk_profile": {
                        "business_impact": "MBI"
                    },
                    "slug": "project1"
                }
            ],
            "resolved_at": "2023-08-09T23:10:22.588Z",
            "service_tickets": [
                {
                    "external_id": "638361121bbfdd10f6c1cbf3604bcb7e",
                    "name": "SIR0010002",
                    "url": "https://ven05658.testing.com/nav_to.do?uri=%2Fsn_si_incident.do%3Fsys_id%3D6385248sdsae421"
                }
            ],
            "severity": "INFORMATIONAL",
            "source_rule": {
                "__typename": "Control",
                "control_description": "These EKS principals assume roles that provide bind, escalate and impersonate permissions. \n\nThe `bind` permission allows users to create bindings to roles with rights they do not already have. The `escalate` permission allows users effectively escalate their privileges. The `impersonate` permission allows users to impersonate and gain the rights of other users in the cluster. Running containers with these permissions has the potential to effectively allow privilege escalation to the cluster-admin level.",
                "id": "wc-id-1335",
                "name": "EKS principals assume roles that provide bind, escalate and impersonate permissions",
                "resolution_recommendation": "To follow the principle of least privilege and minimize the risk of unauthorized access and data breaches, it is recommended not to grant `bind`, `escalate` or `impersonate` permissions.",
                "security_sub_categories": [
                    {
                        "category": {
                            "framework": {
                                "name": "CIS EKS 1.2.0"
                            },
                            "name": "4.1 RBAC and Service Accounts"
                        },
                        "title": "4.1.8 Limit use of the Bind, Impersonate and Escalate permissions in the Kubernetes cluster - Level 1 (Manual)"
                    },
                    {
                        "category": {
                            "framework": {
                                "name": "Wiz for Risk Assessment"
                            },
                            "name": "Identity Management"
                        },
                        "title": "Privileged principal"
                    },
                    {
                        "category": {
                            "framework": {
                                "name": "Wiz"
                            },
                            "name": "9 Container Security"
                        },
                        "title": "Container Security"
                    },
                    {
                        "category": {
                            "framework": {
                                "name": "Wiz for Risk Assessment"
                            },
                            "name": "Container \u0026 Kubernetes Security"
                        },
                        "title": "Cluster misconfiguration"
                    }
                ]
            },
            "status": {
                "changed_at": "2023-07-31T06:26:08.708Z",
                "value": "IN_PROGRESS"
            },
            "updated_at": "2023-08-14T06:06:18.331Z"
        }
    }
}

{
    "@timestamp": "2023-08-16T18:40:57.000Z",
    "agent": {
        "ephemeral_id": "124489e8-14a9-4120-9631-0c55ec182d07",
        "id": "9f35182a-afaa-4788-859d-d523d976b90e",
        "name": "elastic-agent-32792",
        "type": "filebeat",
        "version": "8.14.3"
    },
    "cloud": {
        "account": {
            "name": "wiz-integrations"
        },
        "provider": "AWS",
        "region": "us-east-1"
    },
    "data_stream": {
        "dataset": "wiz.vulnerability",
        "namespace": "32071",
        "type": "logs"
    },
    "device": {
        "id": "c828de0d-4c42-5b1c-946b-2edee094d0b3"
    },
    "ecs": {
        "version": "8.11.0"
    },
    "elastic_agent": {
        "id": "9f35182a-afaa-4788-859d-d523d976b90e",
        "snapshot": false,
        "version": "8.14.3"
    },
    "event": {
        "agent_id_status": "verified",
        "category": [
            "vulnerability"
        ],
        "dataset": "wiz.vulnerability",
        "ingested": "2024-10-08T12:48:23Z",
        "kind": "alert",
        "original": "{\"CVEDescription\":\"In LibTIFF, there is a memory malloc failure in tif_pixarlog.c. A crafted TIFF document can lead to an abort, resulting in a remote denial of service attack.\",\"CVSSSeverity\":\"MEDIUM\",\"dataSourceName\":\"data Source\",\"description\":\"Thepackage`libtiff`version`4.0.3-35.amzn2`wasdetectedin`YUMpackagemanager`onamachinerunning`Amazon2(Karoo)`isvulnerableto`CVE-2020-35522`,whichexistsinversions`\\u003c4.0.3-35.amzn2.0.1`.\\n\\nThevulnerabilitywasfoundinthe[OfficialAmazonLinuxSecurityAdvisories](https://alas.aws.amazon.com/AL2/ALAS-2022-1780.html)withvendorseverity:`Medium`([NVD](https://nvd.nist.gov/vuln/detail/CVE-2020-35522)severity:`Medium`).\\n\\nThevulnerabilitycanberemediatedbyupdatingthepackagetoversion`4.0.3-35.amzn2.0.1`orhigher,using`yumupdatelibtiff`.\",\"detailedName\":\"libtiff\",\"detectionMethod\":\"PACKAGE\",\"epssPercentile\":46.2,\"epssProbability\":0.1,\"epssSeverity\":\"LOW\",\"exploitabilityScore\":1.8,\"firstDetectedAt\":\"2022-05-01T11:36:10.063767Z\",\"fixedVersion\":\"4.0.3-35.amzn2.0.1\",\"hasCisaKevExploit\":false,\"hasExploit\":false,\"id\":\"5e95ff50-5490-514e-87f7-11e56f3230ff\",\"ignoreRules\":{\"enabled\":true,\"expiredAt\":\"2023-08-16T18:40:57Z\",\"id\":\"aj3jqtvnaf\",\"name\":\"abc\"},\"impactScore\":3.6,\"lastDetectedAt\":\"2023-08-16T18:40:57Z\",\"layerMetadata\":{\"details\":\"xxxx\",\"id\":\"5e95ff50-5490-514e-87f7-11e56f3230ff\",\"isBaseLayer\":true},\"link\":\"https://alas.aws.amazon.com/AL2/ALAS-2022-1780.html\",\"locationPath\":\"package/library/file\",\"name\":\"CVE-2020-3333\",\"portalUrl\":\"https://app.wiz.io/explorer/vulnerability-findings#~(entity~(~'xxx-xxx*2cSECURITY_TOOL_FINDING))\",\"projects\":[{\"businessUnit\":\"\",\"id\":\"83b76efe-a7b6-5762-8a53-8e8f59e68bd8\",\"name\":\"Project2\",\"riskProfile\":{\"businessImpact\":\"MBI\"},\"slug\":\"project-2\"},{\"businessUnit\":\"Dev\",\"id\":\"af52828c-4eb1-5c4e-847c-ebc3a5ead531\",\"name\":\"project4\",\"riskProfile\":{\"businessImpact\":\"MBI\"},\"slug\":\"project-4\"},{\"businessUnit\":\"Dev\",\"id\":\"d6ac50bb-aec0-52fc-80ab-bacd7b02f178\",\"name\":\"Project1\",\"riskProfile\":{\"businessImpact\":\"MBI\"},\"slug\":\"project1\"}],\"remediation\":\"yumupdatelibtiff\",\"resolutionReason\":\"resolutionReason\",\"resolvedAt\":\"2023-08-16T18:40:57Z\",\"score\":5.5,\"status\":\"OPEN\",\"validatedInRuntime\":true,\"vendorSeverity\":\"MEDIUM\",\"version\":\"4.0.3-35.amzn2\",\"vulnerableAsset\":{\"cloudPlatform\":\"AWS\",\"cloudProviderURL\":\"https://us-east-1.console.aws.amazon.com/ec2/v2/home?region=us-east-1#InstanceDetails:instanceId=i-0a0f7e1451da5f4a3\",\"hasLimitedInternetExposure\":true,\"hasWideInternetExposure\":true,\"id\":\"c828de0d-4c42-5b1c-946b-2edee094d0b3\",\"ipAddresses\":[\"89.160.20.112\",\"89.160.20.128\"],\"isAccessibleFromOtherSubscriptions\":false,\"isAccessibleFromOtherVnets\":false,\"isAccessibleFromVPN\":false,\"name\":\"test-4\",\"operatingSystem\":\"Linux\",\"providerUniqueId\":\"arn:aws:ec2:us-east-1:998231069301:instance/i-0a0f7e1451da5f4a3\",\"region\":\"us-east-1\",\"status\":\"Active\",\"subscriptionExternalId\":\"998231069301\",\"subscriptionId\":\"94e76baa-85fd-5928-b829-1669a2ca9660\",\"subscriptionName\":\"wiz-integrations\",\"tags\":{\"Name\":\"test-4\"},\"type\":\"VIRTUAL_MACHINE\"}}",
        "type": [
            "info"
        ]
    },
    "host": {
        "name": "test-4",
        "os": {
            "family": "Linux"
        }
    },
    "input": {
        "type": "cel"
    },
    "message": "Thepackage`libtiff`version`4.0.3-35.amzn2`wasdetectedin`YUMpackagemanager`onamachinerunning`Amazon2(Karoo)`isvulnerableto`CVE-2020-35522`,whichexistsinversions`<4.0.3-35.amzn2.0.1`.\n\nThevulnerabilitywasfoundinthe[OfficialAmazonLinuxSecurityAdvisories](https://alas.aws.amazon.com/AL2/ALAS-2022-1780.html)withvendorseverity:`Medium`([NVD](https://nvd.nist.gov/vuln/detail/CVE-2020-35522)severity:`Medium`).\n\nThevulnerabilitycanberemediatedbyupdatingthepackagetoversion`4.0.3-35.amzn2.0.1`orhigher,using`yumupdatelibtiff`.",
    "observer": {
        "vendor": "Wiz"
    },
    "package": {
        "fixed_version": "4.0.3-35.amzn2.0.1",
        "name": "libtiff",
        "version": "4.0.3-35.amzn2"
    },
    "related": {
        "ip": [
            "89.160.20.112",
            "89.160.20.128"
        ]
    },
    "resource": {
        "id": "arn:aws:ec2:us-east-1:998231069301:instance/i-0a0f7e1451da5f4a3",
        "name": "test-4"
    },
    "tags": [
        "preserve_original_event",
        "preserve_duplicate_custom_fields",
        "forwarded",
        "wiz-vulnerability"
    ],
    "vulnerability": {
        "cwe": "CVE-2020-3333",
        "description": "In LibTIFF, there is a memory malloc failure in tif_pixarlog.c. A crafted TIFF document can lead to an abort, resulting in a remote denial of service attack.",
        "id": "CVE-2020-3333",
        "package": {
            "fixed_version": "4.0.3-35.amzn2.0.1",
            "name": "libtiff",
            "version": "4.0.3-35.amzn2"
        },
        "reference": "https://alas.aws.amazon.com/AL2/ALAS-2022-1780.html",
        "score": {
            "base": 5.5
        },
        "severity": "MEDIUM"
    },
    "wiz": {
        "vulnerability": {
            "cve_description": "In LibTIFF, there is a memory malloc failure in tif_pixarlog.c. A crafted TIFF document can lead to an abort, resulting in a remote denial of service attack.",
            "cvss_severity": "MEDIUM",
            "data_source_name": "data Source",
            "description": "Thepackage`libtiff`version`4.0.3-35.amzn2`wasdetectedin`YUMpackagemanager`onamachinerunning`Amazon2(Karoo)`isvulnerableto`CVE-2020-35522`,whichexistsinversions`<4.0.3-35.amzn2.0.1`.\n\nThevulnerabilitywasfoundinthe[OfficialAmazonLinuxSecurityAdvisories](https://alas.aws.amazon.com/AL2/ALAS-2022-1780.html)withvendorseverity:`Medium`([NVD](https://nvd.nist.gov/vuln/detail/CVE-2020-35522)severity:`Medium`).\n\nThevulnerabilitycanberemediatedbyupdatingthepackagetoversion`4.0.3-35.amzn2.0.1`orhigher,using`yumupdatelibtiff`.",
            "detailed_name": "libtiff",
            "detection_method": "PACKAGE",
            "epss": {
                "percentile": 46.2,
                "probability": 0.1,
                "severity": "LOW"
            },
            "exploitability_score": 1.8,
            "first_detected_at": "2022-05-01T11:36:10.063Z",
            "fixed_version": "4.0.3-35.amzn2.0.1",
            "has_cisa_kev_exploit": false,
            "has_exploit": false,
            "id": "5e95ff50-5490-514e-87f7-11e56f3230ff",
            "ignore_rules": {
                "enabled": true,
                "expired_at": "2023-08-16T18:40:57.000Z",
                "id": "aj3jqtvnaf",
                "name": "abc"
            },
            "impact_score": 3.6,
            "last_detected_at": "2023-08-16T18:40:57.000Z",
            "layer_metadata": {
                "details": "xxxx",
                "id": "5e95ff50-5490-514e-87f7-11e56f3230ff",
                "is_base_layer": true
            },
            "link": "https://alas.aws.amazon.com/AL2/ALAS-2022-1780.html",
            "location_path": "package/library/file",
            "name": "CVE-2020-3333",
            "portal_url": "https://app.wiz.io/explorer/vulnerability-findings#~(entity~(~'xxx-xxx*2cSECURITY_TOOL_FINDING))",
            "projects": [
                {
                    "id": "83b76efe-a7b6-5762-8a53-8e8f59e68bd8",
                    "name": "Project2",
                    "risk_profile": {
                        "business_impact": "MBI"
                    },
                    "slug": "project-2"
                },
                {
                    "business_unit": "Dev",
                    "id": "af52828c-4eb1-5c4e-847c-ebc3a5ead531",
                    "name": "project4",
                    "risk_profile": {
                        "business_impact": "MBI"
                    },
                    "slug": "project-4"
                },
                {
                    "business_unit": "Dev",
                    "id": "d6ac50bb-aec0-52fc-80ab-bacd7b02f178",
                    "name": "Project1",
                    "risk_profile": {
                        "business_impact": "MBI"
                    },
                    "slug": "project1"
                }
            ],
            "remedation": "yumupdatelibtiff",
            "resolution_reason": "resolutionReason",
            "resolved_at": "2023-08-16T18:40:57.000Z",
            "score": 5.5,
            "status": "OPEN",
            "validated_in_runtime": true,
            "vendor_severity": "MEDIUM",
            "version": "4.0.3-35.amzn2",
            "vulnerable_asset": {
                "cloud": {
                    "platform": "AWS",
                    "provider_url": "https://us-east-1.console.aws.amazon.com/ec2/v2/home?region=us-east-1#InstanceDetails:instanceId=i-0a0f7e1451da5f4a3"
                },
                "has_limited_internet_exposure": true,
                "has_wide_internet_exposure": true,
                "id": "c828de0d-4c42-5b1c-946b-2edee094d0b3",
                "ip_addresses": [
                    "89.160.20.112",
                    "89.160.20.128"
                ],
                "is_accessible_from": {
                    "other_subscriptions": false,
                    "other_vnets": false,
                    "vpn": false
                },
                "name": "test-4",
                "operating_system": "Linux",
                "provider_unique_id": "arn:aws:ec2:us-east-1:998231069301:instance/i-0a0f7e1451da5f4a3",
                "region": "us-east-1",
                "status": "Active",
                "subscription": {
                    "external_id": "998231069301",
                    "id": "94e76baa-85fd-5928-b829-1669a2ca9660",
                    "name": "wiz-integrations"
                },
                "tags": {
                    "name": "test-4"
                },
                "type": "VIRTUAL_MACHINE"
            }
        }
    }
}