Wiz (Cloud Security)

The Wiz CNAPP Connector solves the fragmentation problem of managing cloud security findings across multiple platforms by centralizing asset and vulnerability data from Wiz into Qualys Enterprise TruRisk Management. It enables security teams to gain centralized cloud risk visibility across storage, compute, container instances, and container images without manual data reconciliation.

By automatically syncing vulnerability findings through a unidirectional API integration, the connector reduces operational overhead and improves risk assessment accuracy. This unified view allows security practitioners to correlate findings across their cloud infrastructure and make faster remediation decisions from a single platform.

Connector Details

The following table provides details of the Wiz CNAPP connector.

Vendor	Wiz
Product Name	Wiz CWP
Connector Category	Wiz CNAPP
Asset Types Supported	Storage, Compute, Container Instances, Container Images
Finding Types Supported	Vulnerabilities
Supported Version & Type	SaaS
Integration Method	API Integration (REST / GraphQL)
Direction	Unidirectional (Wiz to Qualys)
Incremental Sync (Delta)	Supported

Asset and Vulnerability Details

Category	Supported Asset Type	Supported Finding Type
Compute	Virtual Machine	Misconfiguration, Vulnerabilities
Storage	Bucket	Misconfiguration, Vulnerabilities
Storage	File System Service	Misconfiguration, Vulnerabilities
Storage	Storage Account	Misconfiguration, Vulnerabilities
Container	Container Image	Vulnerabilities
Container	Container Instance	Misconfiguration, Vulnerabilities
Application	Serverless	Misconfiguration, Vulnerabilities

Connection Settings

User Roles and Permissions

To configure the Wiz CNAPP connector, you must create a Wiz service account with appropriate API permissions.

Entity Type	Required Permissions
Vulnerability Findings	read:vulnerabilities
Assets	read:resources

You need the following Wiz API Access information to configure the connection:

• Wiz API Endpoint URL (e.g., https://api.<region>.app.wiz.io)
• Wiz Client ID
• Wiz Client Secret
• Token URL

Refer here for the detailed steps to generate the required information.

For quick reference on how to obtain the required values, follow the steps below.

API Endpoint URL

Your Wiz API Endpoint URL follows the format below.

https://api.<TENANT_DATA_CENTER>.<ENVIRONMENT>

Where,

• The <TENANT_DATA_CENTER> is the regional data center of your wiz account(e.g., us1, us2, or eu1)
• The <ENVIRONMENT> is one of the following three - app.wiz.io, app.wiz.us, or gov.wiz.io.

Type of Environment	Value	Example
Commercial (Standard)	app.wiz.io	https://api.us17.app.wiz.io
Gov (FedRAMP)	app.wiz.us	https://api.us17.app.wiz.us
Commercial AWS GovCloud	gov.wiz.io	https://api.us17.gov.wiz.io

The above values are samples. Use the appropriate Tenant Data Center for your purpose.

How to obtain the Tenant Data Center

At the top right of your Wiz portal, click the User icon > Tenant Info (here). 

At the left side, click Data Center and Regions (here). Copy the Tenant Data Center.

Client ID and Client Secret

To obtain the Client ID and Client Secret values, you need to create a service account with the required permissions.

Log in to your Wiz account with the Project Admin role.

1. Navigate to Settings > Service Accounts
2. Click Add Service Accounts
3. Provide a Service Account Name
4. Select the Type as Custom Integration - GraphQL
5. Select the projects to limit access to
6. For Vulnerabilities, select the read:vulnerabilities permission and for Assets, select the read:resources permission in the API Scopes.
7. Click Add Service Account
8. The page displays a Client ID and Client Secret. Securely store these values for later use

Authentication Details

Provide the following credentials when configuring the connector:

Name	Description
Wiz API Endpoint URL	Base API endpoint for your Wiz tenant. Example (https://api.<region>.app.wiz.io)
Client ID	Service account Client ID
Client Secret	Service account Client Secret
Token URL	OAuth token endpoint for the Wiz tenant

API Endpoint URL Format

https://api.<TENANT_DATA_CENTER>.<ENVIRONMENT>

Environment Type	Value	Example
Commercial (Standard)	app.wiz.io	https://api.us17.app.wiz.io
Gov (FedRAMP)	app.wiz.us	https://api.us17.app.wiz.us
AWS GovCloud	gov.wiz.io	https://api.us17.gov.wiz.io

Token URL

Tenant Type	Token Endpoint
Wiz Commercial	https://auth.app.wiz.io/oauth/token
Wiz Gov (FedRAMP)	https://auth.app.wiz.us/oauth/token
Wiz AWS GovCloud	https://auth.gov.wiz.io/oauth/token

Connector Configuration

Basic Details

1. Log in to Qualys ETM.
2. Navigate to Connectors > Integration.
3. Locate Wiz CNAPP Connector and click Manage.
4. Provide a connector Name and Description.
5. Enter authentication details.

Schedule

Schedules control the execution and scope of the connector.

1. Configure Schedule.
2. Select supported Asset Types.
3. Select Findings to ingest.

Asset Identification Rules

The Identification Rules are a set of out-of-the-box precedence rules set by Qualys CSAM. The connector discovers findings based on the order set by the selected Identification Rules.

These rules are applicable only to compute asset types. Other asset classes are not affected.

You can proceed to the next step without making any changes to this screen.

How Does the Connection Work?

On schedule (or on-demand), the Wiz CNAPP connector retrieves selected asset classes and vulnerability findings from Wiz and imports them into ETM Inventory.

In the Connector screen, you can find your newly configured connector listed and marked in the Processed state.

Connector States

A successfully configured connector goes through 4 states.

1. Registered - The connector is successfully created and registered to fetch data from the vendor.
2. Scheduled - The connector is scheduled to execute a connection with the vendor.
3. Processing - A connection is executed and the connector is fetching the asset and findings data.
4. Processed - The connector has successfully fetched the assets; it may still be under process of fetching the findings. Wait for some more time for the connector to fetch the findings completely.

The Processed state indicates that the Connector is successfully configured but it is under the process of importing all your assets and findings. This process (specifically for findings) may take some time.

This entire process may take up to 2 hours for completion. Once it is done, you can find the imported data in Enterprise TruRisk Management (ETM).

Viewing Assets and Findings in ETM

After ingestion, view WIZ assets in ETM Unified Asset Inventory.

• Assets: Enterprise TruRisk Management > Inventory > Assets > All Assets. Use the tag or asset filter: tags.name:"Wiz" or asset.inventory:"Wiz". 
  
• Findings: Enterprise TruRisk Management > Risk Management > Findings > Vulnerability. Use the vendor filter: findings.vendorProductname:"Wiz".
  
   You can click on any findings to open a detailed view.
  

API Reference

Here are the APIs executed for the Wiz CNAPP connection.

API	Endpoint
Authentication	https://auth.app.wiz.io/oauth/token
GraphQL	https://api.<tenant>.app.wiz.io/graphql

WIZ CNAPP Transformation Map

The default transformation map configured for the WIZ CNAPP connector is fetched from the database and utilized during the execution of the connector profile to perform data transformation.

Compute Transformation Map

AWS EC2

graphEntity.properties.deployment Coverage_sensor_deploymentStatus	asset.assetDetail.typedAttributes.&
graphEntity.properties.deployment Coverage_sensor_recommendedSensorType	asset.assetDetail.typedAttributes.&
graphEntity.properties.deployment Coverage_sensor_workloadScanner_deploymentStatus	asset.assetDetail.typedAttributes.&
graphEntity.properties.deployment Coverage_sensor_installed	asset.assetDetail.typedAttributes.&
graphEntity.properties.name	asset.assetDetail.hostname
graphEntity.properties.name	asset.assetDetail.hostIdentity.hostname
graphEntity.properties.fullResourceName	asset.assetDetail.typedAttributes.&
graphEntity.properties.instanceType	asset.assetDetail.typedAttributes.&
graphEntity.properties.isContainerHost	asset.assetDetail.typedAttributes.&
graphEntity.properties.isEphemeral	asset.assetDetail.typedAttributes.&
graphEntity.properties.isManaged	asset.assetDetail.typedAttributes.&
isOpenToAllInternet	asset.assetDetail.typedAttributes.&
isAccessibleFromInternet	asset.assetDetail.typedAttributes.&
hasAccessToSensitiveData	asset.assetDetail.typedAttributes.&
hasAdminPrivileges	asset.assetDetail.typedAttributes.&
hasHighPrivileges	asset.assetDetail.typedAttributes.&
hasSensitiveData	asset.assetDetail.typedAttributes.&
graphEntity.properties.externalId	asset.assetHeader.externalAssetId
FUNCTION_PICKER	asset.assetHeader.status
graphEntity.properties._vertexID	asset.assetHeader.vendorAssetId
graphEntity.properties.name	asset.assetDetail.name
graphEntity.properties.name	asset.assetDetail.computeAssetClass. cloudInstance.hostname
graphEntity.properties.name	asset.assetDetail.network[].hostname
graphEntity.properties.vCPUs	asset.assetDetail.processor.numberOfCpu
graphEntity.properties.creationDate	asset.assetDetail.sourceCreatedAt
graphEntity.properties.updatedAt	asset.assetDetail.sourceUpdatedAt
deletedAt	asset.assetDetail.sourceDeletedAt
graphEntity.properties.cloudPlatform	asset.assetDetail.cloudInfo.provider
cloudAccount.id	asset.assetDetail.cloudInfo.accountId
cloudAccount.name	asset.assetDetail.cloudInfo.accountName
graphEntity.properties.zone	asset.assetDetail.cloudInfo.availabilityZone
region	asset.assetDetail.cloudInfo.region
graphEntity.properties.cloudProviderURL	asset.assetDetail.cloudInfo.providerUrl
tags[].key	asset.assetDetail.externalTags[].key
tags[].value	asset.assetDetail.externalTags[].value
graphEntity.properties.validatedOpenPorts[]	asset.assetDetail.computeAssetClass.openPorts[].port
graphEntity.properties.deployment Coverage_sensor_apiSecurity_deploymentStatus	asset.assetDetail.computeAssetClass.services[].status
id	asset.assetDetail.computeAssetClass.cloudInstance.id
typeFields.instanceType	asset.assetDetail.computeAssetClass.cloudInstance.type
typeFields.ipAddresses[]	asset.assetDetail.network[].ipv4Addresses[]
typeFields.operatingSystem	asset.assetDetail.operatingSystem.name

OCI VM

graphEntity.properties.deployment Coverage_sensor_deploymentStatus	asset.assetDetail.typedAttributes.&
typeFields.ipAddresses[]	asset.assetDetail.network[].ipv4Addresses[]
graphEntity.properties.deployment Coverage_sensor_recommendedSensorType	asset.assetDetail.typedAttributes.&
graphEntity.properties.deployment Coverage_sensor_workloadScanner_deploymentStatus	asset.assetDetail.typedAttributes.&
graphEntity.properties.deployment Coverage_sensor_installed	asset.assetDetail.typedAttributes.&
graphEntity.properties.fullResourceName	asset.assetDetail.typedAttributes.&
graphEntity.properties.instanceType	asset.assetDetail.typedAttributes.&
graphEntity.properties.isContainerHost	asset.assetDetail.typedAttributes.&
graphEntity.properties.isEphemeral	asset.assetDetail.typedAttributes.&
graphEntity.properties.isManaged	asset.assetDetail.typedAttributes.&
isOpenToAllInternet	asset.assetDetail.typedAttributes.&
isAccessibleFromInternet	asset.assetDetail.typedAttributes.&
hasAccessToSensitiveData	asset.assetDetail.typedAttributes.&
hasAdminPrivileges	asset.assetDetail.typedAttributes.&
hasHighPrivileges	asset.assetDetail.typedAttributes.&
hasSensitiveData	asset.assetDetail.typedAttributes.&
graphEntity.properties.externalId	asset.assetHeader.externalAssetId
FUNCTION_PICKER	asset.assetHeader.status
graphEntity.properties.providerUniqueId	asset.assetHeader.vendorAssetId
graphEntity.properties.name	asset.assetDetail.name
graphEntity.properties.name	asset.assetDetail.hostIdentity.hostname
graphEntity.properties.name	asset.assetDetail.network[].hostname
graphEntity.properties.name	asset.assetDetail.computeAssetClass. cloudInstance.hostname
graphEntity.properties.name	asset.assetDetail.hostname
graphEntity.properties.vCPUs	asset.assetDetail.processor.numberOfCpu
graphEntity.properties.creationDate	asset.assetDetail.sourceCreatedAt
graphEntity.properties.updatedAt	asset.assetDetail.sourceUpdatedAt
deletedAt	asset.assetDetail.sourceDeletedAt
graphEntity.properties.cloudPlatform	asset.assetDetail.cloudInfo.provider
cloudAccount.id	asset.assetDetail.cloudInfo.accountId
cloudAccount.name	asset.assetDetail.cloudInfo.accountName
graphEntity.properties.zone	asset.assetDetail.cloudInfo.availabilityZone
region	asset.assetDetail.cloudInfo.region
graphEntity.properties.cloudProviderURL	asset.assetDetail.cloudInfo.providerUrl
tags[].key	asset.assetDetail.externalTags[].key
tags[].value	asset.assetDetail.externalTags[].value
graphEntity.properties.validatedOpenPorts[]	asset.assetDetail.computeAssetClass.openPorts[].port
graphEntity.properties.deployment Coverage_sensor_apiSecurity_deploymentStatus	asset.assetDetail.computeAssetClass.services[].status
id	asset.assetDetail.computeAssetClass.cloudInstance.id
typeFields.instanceType	asset.assetDetail.computeAssetClass.cloudInstance.type
typeFields.operatingSystem	asset.assetDetail.operatingSystem.name

GCP VM

sourceField	targetField
graphEntity.properties.deploymentCoverage_sensor_deploymentStatus	asset.assetDetail.typedAttributes.&
typeFields.ipAddresses[]	asset.assetDetail.network[].ipv4Addresses[]
graphEntity.properties.deploymentCoverage_sensor_recommendedSensorType	asset.assetDetail.typedAttributes.&
graphEntity.properties.deploymentCoverage_sensor_workloadScanner_deploymentStatus	asset.assetDetail.typedAttributes.&
graphEntity.properties.deploymentCoverage_sensor_installed	asset.assetDetail.typedAttributes.&
graphEntity.properties.fullResourceName	asset.assetDetail.typedAttributes.&
graphEntity.properties.instanceType	asset.assetDetail.typedAttributes.&
graphEntity.properties.isContainerHost	asset.assetDetail.typedAttributes.&
graphEntity.properties.isEphemeral	asset.assetDetail.typedAttributes.&
graphEntity.properties.isManaged	asset.assetDetail.typedAttributes.&
isOpenToAllInternet	asset.assetDetail.typedAttributes.&
isAccessibleFromInternet	asset.assetDetail.typedAttributes.&
hasAccessToSensitiveData	asset.assetDetail.typedAttributes.&
hasAdminPrivileges	asset.assetDetail.typedAttributes.&
hasHighPrivileges	asset.assetDetail.typedAttributes.&
hasSensitiveData	asset.assetDetail.typedAttributes.&
graphEntity.properties.name	asset.assetDetail.hostname
graphEntity.properties.externalId	asset.assetHeader.externalAssetId
FUNCTION_PICKER	asset.assetHeader.status
graphEntity.properties.providerUniqueId	asset.assetHeader.vendorAssetId
graphEntity.properties.name	asset.assetDetail.name
graphEntity.properties.name	asset.assetDetail.hostIdentity.hostname
graphEntity.properties.name	asset.assetDetail.computeAssetClass.cloudInstance.hostname
graphEntity.properties.name	asset.assetDetail.network[].hostname
graphEntity.properties.vCPUs	asset.assetDetail.processor.numberOfCpu
graphEntity.properties.creationDate	asset.assetDetail.sourceCreatedAt
graphEntity.properties.updatedAt	asset.assetDetail.sourceUpdatedAt
deletedAt	asset.assetDetail.sourceDeletedAt
graphEntity.properties.cloudPlatform	asset.assetDetail.cloudInfo.provider
cloudAccount.id	asset.assetDetail.cloudInfo.accountId
cloudAccount.name	asset.assetDetail.cloudInfo.accountName
graphEntity.properties.zone	asset.assetDetail.cloudInfo.availabilityZone
region	asset.assetDetail.cloudInfo.region
graphEntity.properties.cloudProviderURL	asset.assetDetail.cloudInfo.providerUrl
tags[].key	asset.assetDetail.externalTags[].key
tags[].value	asset.assetDetail.externalTags[].value
graphEntity.properties.validatedOpenPorts[]	asset.assetDetail.computeAssetClass.openPorts[].port
graphEntity.properties.deploymentCoverage_sensor_apiSecurity_deploymentStatus	asset.assetDetail.computeAssetClass.services[].status
id	asset.assetDetail.computeAssetClass.cloudInstance.id
typeFields.instanceType	asset.assetDetail.computeAssetClass.cloudInstance.type
typeFields.operatingSystem	asset.assetDetail.operatingSystem.name

AZURE VM

sourceField	targetField
graphEntity.properties.deployment Coverage_sensor_deploymentStatus	asset.assetDetail.typedAttributes.&
typeFields.ipAddresses[]	asset.assetDetail.network[].ipv4Addresses[]
graphEntity.properties.deployment Coverage_sensor_recommendedSensorType	asset.assetDetail.typedAttributes.&
graphEntity.properties.deployment Coverage_sensor_workloadScanner_deploymentStatus	asset.assetDetail.typedAttributes.&
graphEntity.properties.deployment Coverage_sensor_installed	asset.assetDetail.typedAttributes.&
graphEntity.properties.fullResourceName	asset.assetDetail.typedAttributes.&
graphEntity.properties.instanceType	asset.assetDetail.typedAttributes.&
graphEntity.properties.isContainerHost	asset.assetDetail.typedAttributes.&
graphEntity.properties.isEphemeral	asset.assetDetail.typedAttributes.&
graphEntity.properties.isManaged	asset.assetDetail.typedAttributes.&
isOpenToAllInternet	asset.assetDetail.typedAttributes.&
isAccessibleFromInternet	asset.assetDetail.typedAttributes.&
hasAccessToSensitiveData	asset.assetDetail.typedAttributes.&
hasAdminPrivileges	asset.assetDetail.typedAttributes.&
hasHighPrivileges	asset.assetDetail.typedAttributes.&
hasSensitiveData	asset.assetDetail.typedAttributes.&
graphEntity.properties.externalId	asset.assetHeader.externalAssetId
FUNCTION_PICKER	asset.assetHeader.status
graphEntity.properties.providerUniqueId	asset.assetHeader.vendorAssetId
graphEntity.properties.name	asset.assetDetail.name
graphEntity.properties.name	asset.assetDetail.hostIdentity.hostname
graphEntity.properties.name	asset.assetDetail.network[].hostname
graphEntity.properties.name	asset.assetDetail.computeAssetClass.cloudInstance.hostname
graphEntity.properties.name	asset.assetDetail.hostname
graphEntity.properties.vCPUs	asset.assetDetail.processor.numberOfCpu
graphEntity.properties.creationDate	asset.assetDetail.sourceCreatedAt
graphEntity.properties.updatedAt	asset.assetDetail.sourceUpdatedAt
deletedAt	asset.assetDetail.sourceDeletedAt
graphEntity.properties.cloudPlatform	asset.assetDetail.cloudInfo.provider
cloudAccount.id	asset.assetDetail.cloudInfo.accountId
cloudAccount.name	asset.assetDetail.cloudInfo.accountName
graphEntity.properties.zone	asset.assetDetail.cloudInfo.availabilityZone
region	asset.assetDetail.cloudInfo.region
graphEntity.properties.cloudProviderURL	asset.assetDetail.cloudInfo.providerUrl
tags[].key	asset.assetDetail.externalTags[].key
tags[].value	asset.assetDetail.externalTags[].value
graphEntity.properties.validatedOpenPorts[]	asset.assetDetail.computeAssetClass.openPorts[].port
graphEntity.properties.deploymentCoverage_sensor_apiSecurity_deploymentStatus	asset.assetDetail.computeAssetClass.services[].status
id	asset.assetDetail.computeAssetClass.cloudInstance.id
typeFields.instanceType	asset.assetDetail.computeAssetClass.cloudInstance.type
typeFields.operatingSystem	asset.assetDetail.operatingSystem.name

AWS.VIRTUAL_MACHINE_IMAGE

sourceField	targetField
isOpenToAllInternet	asset.assetDetail.typedAttributes.&
isAccessibleFromInternet	asset.assetDetail.typedAttributes.&
hasAccessToSensitiveData	asset.assetDetail.typedAttributes.&
hasAdminPrivileges	asset.assetDetail.typedAttributes.&
hasHighPrivileges	asset.assetDetail.typedAttributes.&
hasSensitiveData	asset.assetDetail.typedAttributes.&
graphEntity.properties.name	asset.assetDetail.hostname
graphEntity.properties.externalId	asset.assetHeader.externalAssetId
FUNCTION_PICKER	asset.assetHeader.status
graphEntity.properties._vertexID	asset.assetHeader.vendorAssetId
graphEntity.properties.name	asset.assetDetail.name
graphEntity.properties.name	asset.assetDetail.computeAssetClass.cloudInstance.hostname
graphEntity.properties.name	asset.assetDetail.network[].hostname
graphEntity.properties.creationDate	asset.assetDetail.sourceCreatedAt
graphEntity.properties.updatedAt	asset.assetDetail.sourceUpdatedAt
graphEntity.properties.cloudPlatform	asset.assetDetail.cloudInfo.provider
graphEntity.properties.subscriptionExternalId	asset.assetDetail.cloudInfo.accountId
graphEntity.properties.zone	asset.assetDetail.cloudInfo.availabilityZone
region	asset.assetDetail.cloudInfo.region
graphEntity.properties.cloudProviderURL	asset.assetDetail.cloudInfo.providerUrl
tags[].key	asset.assetDetail.externalTags[].key
tags[].value	asset.assetDetail.externalTags[].value
deletedAt	asset.assetDetail.sourceDeletedAt

GCP.VIRTUAL_MACHINE_IMAGE

sourceField	targetField
isOpenToAllInternet	asset.assetDetail.typedAttributes.&
isAccessibleFromInternet	asset.assetDetail.typedAttributes.&
hasAccessToSensitiveData	asset.assetDetail.typedAttributes.&
hasAdminPrivileges	asset.assetDetail.typedAttributes.&
hasHighPrivileges	asset.assetDetail.typedAttributes.&
hasSensitiveData	asset.assetDetail.typedAttributes.&
graphEntity.properties.name	asset.assetDetail.hostname
graphEntity.properties.externalId	asset.assetHeader.externalAssetId
FUNCTION_PICKER	asset.assetHeader.status
graphEntity.properties._vertexID	asset.assetHeader.vendorAssetId
graphEntity.properties.name	asset.assetDetail.name
graphEntity.properties.name	asset.assetDetail.computeAssetClass.cloudInstance.hostname
graphEntity.properties.name	asset.assetDetail.network[].hostname
graphEntity.properties.creationDate	asset.assetDetail.sourceCreatedAt
graphEntity.properties.updatedAt	asset.assetDetail.sourceUpdatedAt
graphEntity.properties.cloudPlatform	asset.assetDetail.cloudInfo.provider
graphEntity.properties.projectId	asset.assetDetail.cloudInfo.accountId
graphEntity.properties.zone	asset.assetDetail.cloudInfo.availabilityZone
region	asset.assetDetail.cloudInfo.region
graphEntity.properties.cloudProviderURL	asset.assetDetail.cloudInfo.providerUrl
tags[].key	asset.assetDetail.externalTags[].key
tags[].value	asset.assetDetail.externalTags[].value
deletedAt	asset.assetDetail.sourceDeletedAt

AZURE.VIRTUAL_MACHINE_IMAGE

sourceField	targetField
isOpenToAllInternet	asset.assetDetail.typedAttributes.&
isAccessibleFromInternet	asset.assetDetail.typedAttributes.&
hasAccessToSensitiveData	asset.assetDetail.typedAttributes.&
hasAdminPrivileges	asset.assetDetail.typedAttributes.&
hasHighPrivileges	asset.assetDetail.typedAttributes.&
hasSensitiveData	asset.assetDetail.typedAttributes.&
graphEntity.properties.name	asset.assetDetail.hostname
graphEntity.properties.externalId	asset.assetHeader.externalAssetId
FUNCTION_PICKER	asset.assetHeader.status
graphEntity.properties._vertexID	asset.assetHeader.vendorAssetId
graphEntity.properties.name	asset.assetDetail.name
graphEntity.properties.name	asset.assetDetail.computeAssetClass.cloudInstance.hostname
graphEntity.properties.name	asset.assetDetail.network[].hostname
graphEntity.properties.creationDate	asset.assetDetail.sourceCreatedAt
graphEntity.properties.updatedAt	asset.assetDetail.sourceUpdatedAt
graphEntity.properties.cloudPlatform	asset.assetDetail.cloudInfo.provider
graphEntity.properties.subscriptionExternalId	asset.assetDetail.cloudInfo.accountId
graphEntity.properties.zone	asset.assetDetail.cloudInfo.availabilityZone
region	asset.assetDetail.cloudInfo.region
graphEntity.properties.cloudProviderURL	asset.assetDetail.cloudInfo.providerUrl
tags[].key	asset.assetDetail.externalTags[].key
tags[].value	asset.assetDetail.externalTags[].value
deletedAt	asset.assetDetail.sourceDeletedAt

OCI.VIRTUAL_MACHINE_IMAGE

sourceField	targetField
isOpenToAllInternet	asset.assetDetail.typedAttributes.&
isAccessibleFromInternet	asset.assetDetail.typedAttributes.&
hasAccessToSensitiveData	asset.assetDetail.typedAttributes.&
hasAdminPrivileges	asset.assetDetail.typedAttributes.&
hasHighPrivileges	asset.assetDetail.typedAttributes.&
hasSensitiveData	asset.assetDetail.typedAttributes.&
graphEntity.properties.name	asset.assetDetail.hostname
graphEntity.properties.externalId	asset.assetHeader.externalAssetId
FUNCTION_PICKER	asset.assetHeader.status
graphEntity.properties._vertexID	asset.assetHeader.vendorAssetId
graphEntity.properties.name	asset.assetDetail.name
graphEntity.properties.name	asset.assetDetail.computeAssetClass.cloudInstance.hostname
graphEntity.properties.name	asset.assetDetail.network[].hostname
graphEntity.properties.creationDate	asset.assetDetail.sourceCreatedAt
graphEntity.properties.updatedAt	asset.assetDetail.sourceUpdatedAt
graphEntity.properties.cloudPlatform	asset.assetDetail.cloudInfo.provider
graphEntity.properties.tenantId	asset.assetDetail.cloudInfo.accountId
graphEntity.properties.zone	asset.assetDetail.cloudInfo.availabilityZone
region	asset.assetDetail.cloudInfo.region
graphEntity.properties.cloudProviderURL	asset.assetDetail.cloudInfo.providerUrl
tags[].key	asset.assetDetail.externalTags[].key
tags[].value	asset.assetDetail.externalTags[].value
deletedAt	asset.assetDetail.sourceDeletedAt

STORAGE

AWS.FILE_SYSTEM_SERVICE.ELASTICFILESYSTEM

sourceField	targetField
graphEntity.properties.accessibleFrom.internet	asset.assetDetail.typedAttributes.&
graphEntity.properties.atRestEncryption	asset.assetDetail.typedAttributes.&
graphEntity.properties.cloudPlatform	asset.assetDetail.cloudInfo.provider
graphEntity.properties.cloudProviderURL	asset.assetDetail.cloudInfo.providerUrl
graphEntity.properties.creationDate	asset.assetDetail.sourceCreatedAt
graphEntity.properties.encryptedAtRest	asset.assetDetail.typedAttributes.&
graphEntity.properties.providerUniqueId	asset.assetHeader.externalAssetId
graphEntity.properties._vertexID	asset.assetHeader.vendorAssetId
graphEntity.properties.name	asset.assetDetail.hostname
graphEntity.properties.name	asset.assetDetail.name
graphEntity.properties.publicAccessTypes	asset.assetDetail.typedAttributes.&
graphEntity.properties.region	asset.assetDetail.cloudInfo.region
FUNCTION_PICKER	asset.assetHeader.status
graphEntity.properties.updatedAt	asset.assetDetail.sourceUpdatedAt
graphEntity.properties.zone	asset.assetDetail.cloudInfo.availabilityZone
cloudAccount.id	asset.assetDetail.cloudInfo.accountId
cloudAccount.name	asset.assetDetail.cloudInfo.accountName
tags[].key	asset.assetDetail.externalTags[].key
tags[].value	asset.assetDetail.externalTags[].value
deletedAt	asset.assetDetail.sourceDeletedAt
isOpenToAllInternet	asset.assetDetail.typedAttributes.&
isAccessibleFromInternet	asset.assetDetail.typedAttributes.&
hasAccessToSensitiveData	asset.assetDetail.typedAttributes.&
hasAdminPrivileges	asset.assetDetail.typedAttributes.&
hasHighPrivileges	asset.assetDetail.typedAttributes.&
hasSensitiveData	asset.assetDetail.typedAttributes.&

 

AWS.BUCKET.BUCKET

sourceField	targetField
graphEntity.properties.accessibleFrom.internet	asset.assetDetail.typedAttributes.&
graphEntity.properties.atRestEncryption	asset.assetDetail.typedAttributes.&
graphEntity.properties.cloudPlatform	asset.assetDetail.cloudInfo.provider
graphEntity.properties.cloudProviderURL	asset.assetDetail.cloudInfo.providerUrl
graphEntity.properties.creationDate	asset.assetDetail.sourceCreatedAt
graphEntity.properties.encrypted	asset.assetDetail.storageAssetClass.encryption.enabled
graphEntity.properties.encryptedAtRest	asset.assetDetail.typedAttributes.&
graphEntity.properties.encryptionInTransit	asset.assetDetail.typedAttributes.&
graphEntity.properties.providerUniqueId	asset.assetHeader.externalAssetId
graphEntity.properties._vertexID	asset.assetHeader.vendorAssetId
graphEntity.properties.isPublic	asset.assetDetail.typedAttributes.&
graphEntity.properties.loggingEnabled	asset.assetDetail.typedAttributes.&
graphEntity.properties.name	asset.assetDetail.name
graphEntity.properties.publicExposure	asset.assetDetail.typedAttributes.&
graphEntity.properties.region	asset.assetDetail.cloudInfo.region
graphEntity.properties.retentionPeriod	asset.assetDetail.typedAttributes.&
FUNCTION_PICKER	asset.assetHeader.status
graphEntity.properties.updatedAt	asset.assetDetail.sourceUpdatedAt
graphEntity.properties.versioningEnabled	asset.assetDetail.typedAttributes.&
graphEntity.properties.webHostingEnabled	asset.assetDetail.typedAttributes.&
graphEntity.properties.zone	asset.assetDetail.cloudInfo.availabilityZone
cloudAccount.id	asset.assetDetail.cloudInfo.accountId
cloudAccount.name	asset.assetDetail.cloudInfo.accountName
tags[].key	asset.assetDetail.externalTags[].key
tags[].value	asset.assetDetail.externalTags[].value
deletedAt	asset.assetDetail.sourceDeletedAt
isOpenToAllInternet	asset.assetDetail.typedAttributes.&
isAccessibleFromInternet	asset.assetDetail.typedAttributes.&
hasAccessToSensitiveData	asset.assetDetail.typedAttributes.&
hasAdminPrivileges	asset.assetDetail.typedAttributes.&
hasHighPrivileges	asset.assetDetail.typedAttributes.&
hasSensitiveData	asset.assetDetail.typedAttributes.&

AZURE.FILE_SYSTEM_SERVICE.STORAGEACCOUNTSFILESERVICESSHARES

sourceField	targetField
graphEntity.properties.accessibleFrom.internet	asset.assetDetail.typedAttributes.&
graphEntity.properties.atRestEncryption	asset.assetDetail.typedAttributes.&
graphEntity.properties.cloudPlatform	asset.assetDetail.cloudInfo.provider
graphEntity.properties.cloudProviderURL	asset.assetDetail.cloudInfo.providerUrl
graphEntity.properties.creationDate	asset.assetDetail.sourceCreatedAt
graphEntity.properties.encryptedAtRest	asset.assetDetail.typedAttributes.&
graphEntity.properties.encryptionInTransit	asset.assetDetail.typedAttributes.&
graphEntity.properties.externalId	asset.assetHeader.externalAssetId
graphEntity.properties._vertexID	asset.assetHeader.vendorAssetId
graphEntity.properties.inTransitEncryption	asset.assetDetail.typedAttributes.&
graphEntity.properties.name	asset.assetDetail.name
graphEntity.properties.region	asset.assetDetail.cloudInfo.region
FUNCTION_PICKER	asset.assetHeader.status
graphEntity.properties.updatedAt	asset.assetDetail.sourceUpdatedAt
graphEntity.properties.zone	asset.assetDetail.cloudInfo.availabilityZone
cloudAccount.id	asset.assetDetail.cloudInfo.accountId
cloudAccount.name	asset.assetDetail.cloudInfo.accountName
tags[].key	asset.assetDetail.externalTags[].key
tags[].value	asset.assetDetail.externalTags[].value
deletedAt	asset.assetDetail.sourceDeletedAt
isOpenToAllInternet	asset.assetDetail.typedAttributes.&
isAccessibleFromInternet	asset.assetDetail.typedAttributes.&
hasAccessToSensitiveData	asset.assetDetail.typedAttributes.&
hasAdminPrivileges	asset.assetDetail.typedAttributes.&
hasHighPrivileges	asset.assetDetail.typedAttributes.&
hasSensitiveData	asset.assetDetail.typedAttributes.&

OCI.FILE_SYSTEM_SERVICE.OCIFILESYSTEM

sourceField	targetField
graphEntity.properties.accessibleFrom.internet	asset.assetDetail.typedAttributes.&
graphEntity.properties.atRestEncryption	asset.assetDetail.typedAttributes.&
graphEntity.properties.cloudPlatform	asset.assetDetail.cloudInfo.provider
graphEntity.properties.cloudProviderURL	asset.assetDetail.cloudInfo.providerUrl
graphEntity.properties.creationDate	asset.assetDetail.sourceCreatedAt
graphEntity.properties.encryptedAtRest	asset.assetDetail.typedAttributes.&
graphEntity.properties.externalId	asset.assetHeader.externalAssetId
graphEntity.properties._vertexID	asset.assetHeader.vendorAssetId
graphEntity.properties.name	asset.assetDetail.name
graphEntity.properties.region	asset.assetDetail.cloudInfo.region
FUNCTION_PICKER	asset.assetHeader.status
graphEntity.properties.updatedAt	asset.assetDetail.sourceUpdatedAt
graphEntity.properties.zone	asset.assetDetail.cloudInfo.availabilityZone
cloudAccount.id	asset.assetDetail.cloudInfo.accountId
cloudAccount.name	asset.assetDetail.cloudInfo.accountName
tags[].key	asset.assetDetail.externalTags[].key
tags[].value	asset.assetDetail.externalTags[].value
deletedAt	asset.assetDetail.sourceDeletedAt
isOpenToAllInternet	asset.assetDetail.typedAttributes.&
isAccessibleFromInternet	asset.assetDetail.typedAttributes.&
hasAccessToSensitiveData	asset.assetDetail.typedAttributes.&
hasAdminPrivileges	asset.assetDetail.typedAttributes.&
hasHighPrivileges	asset.assetDetail.typedAttributes.&
hasSensitiveData	asset.assetDetail.typedAttributes.&

AWS.FILE_SYSTEM_SERVICE.FSXFILESYSTEMNETAPP

sourceField	targetField
graphEntity.properties.accessibleFrom.internet	asset.assetDetail.typedAttributes.&
graphEntity.properties.atRestEncryption	asset.assetDetail.typedAttributes.&
graphEntity.properties.cloudPlatform	asset.assetDetail.cloudInfo.provider
graphEntity.properties.cloudProviderURL	asset.assetDetail.cloudInfo.providerUrl
graphEntity.properties.creationDate	asset.assetDetail.sourceCreatedAt
graphEntity.properties.encryptedAtRest	asset.assetDetail.typedAttributes.&
graphEntity.properties.encryptionInTransit	asset.assetDetail.typedAttributes.&
graphEntity.properties.providerUniqueId	asset.assetHeader.externalAssetId
graphEntity.properties._vertexID	asset.assetHeader.vendorAssetId
graphEntity.properties.name	asset.assetDetail.name
graphEntity.properties.publicAccessTypes	asset.assetDetail.typedAttributes.&
graphEntity.properties.region	asset.assetDetail.cloudInfo.region
FUNCTION_PICKER	asset.assetHeader.status
graphEntity.properties.updatedAt	asset.assetDetail.sourceUpdatedAt
graphEntity.properties.zone	asset.assetDetail.cloudInfo.availabilityZone
cloudAccount.id	asset.assetDetail.cloudInfo.accountId
cloudAccount.name	asset.assetDetail.cloudInfo.accountName
tags[].key	asset.assetDetail.externalTags[].key
tags[].value	asset.assetDetail.externalTags[].value
deletedAt	asset.assetDetail.sourceDeletedAt
isOpenToAllInternet	asset.assetDetail.typedAttributes.&
isAccessibleFromInternet	asset.assetDetail.typedAttributes.&
hasAccessToSensitiveData	asset.assetDetail.typedAttributes.&
hasAdminPrivileges	asset.assetDetail.typedAttributes.&
hasHighPrivileges	asset.assetDetail.typedAttributes.&
hasSensitiveData	asset.assetDetail.typedAttributes.&

GCP.BUCKET.STORAGEBUCKET

sourceField	targetField
graphEntity.properties.accessibleFrom.internet	asset.assetDetail.typedAttributes.&
graphEntity.properties.atRestEncryption	asset.assetDetail.typedAttributes.&
graphEntity.properties.cloudPlatform	asset.assetDetail.cloudInfo.provider
graphEntity.properties.cloudProviderURL	asset.assetDetail.cloudInfo.providerUrl
graphEntity.properties.creationDate	asset.assetDetail.sourceCreatedAt
graphEntity.properties.encryptedAtRest	asset.assetDetail.typedAttributes.&
graphEntity.properties.encryptionInTransit	asset.assetDetail.typedAttributes.&
graphEntity.properties.externalId	asset.assetHeader.externalAssetId
graphEntity.properties._vertexID	asset.assetHeader.vendorAssetId
graphEntity.properties.isPublic	asset.assetDetail.typedAttributes.&
graphEntity.properties.loggingEnabled	asset.assetDetail.typedAttributes.&
graphEntity.properties.name	asset.assetDetail.name
graphEntity.properties.publicExposure	asset.assetDetail.typedAttributes.&
graphEntity.properties.region	asset.assetDetail.cloudInfo.region
graphEntity.properties.retentionPeriod	asset.assetDetail.typedAttributes.&
FUNCTION_PICKER	asset.assetHeader.status
graphEntity.properties.updatedAt	asset.assetDetail.sourceUpdatedAt
graphEntity.properties.versioningEnabled	asset.assetDetail.typedAttributes.&
graphEntity.properties.webHostingEnabled	asset.assetDetail.typedAttributes.&
graphEntity.properties.zone	asset.assetDetail.cloudInfo.availabilityZone
cloudAccount.id	asset.assetDetail.cloudInfo.accountId
cloudAccount.name	asset.assetDetail.cloudInfo.accountName
tags[].key	asset.assetDetail.externalTags[].key
tags[].value	asset.assetDetail.externalTags[].value
deletedAt	asset.assetDetail.sourceDeletedAt
isOpenToAllInternet	asset.assetDetail.typedAttributes.&
isAccessibleFromInternet	asset.assetDetail.typedAttributes.&
hasAccessToSensitiveData	asset.assetDetail.typedAttributes.&
hasAdminPrivileges	asset.assetDetail.typedAttributes.&
hasHighPrivileges	asset.assetDetail.typedAttributes.&
hasSensitiveData	asset.assetDetail.typedAttributes.&

AZURE.BUCKET.STORAGEACCOUNTSBLOBSERVICESCONTAINERS

sourceField	targetField
graphEntity.properties.accessibleFrom.internet	asset.assetDetail.typedAttributes.&
graphEntity.properties.atRestEncryption	asset.assetDetail.typedAttributes.&
graphEntity.properties.cloudPlatform	asset.assetDetail.cloudInfo.provider
graphEntity.properties.cloudProviderURL	asset.assetDetail.cloudInfo.providerUrl
graphEntity.properties.creationDate	asset.assetDetail.sourceCreatedAt
graphEntity.properties.encryptedAtRest	asset.assetDetail.typedAttributes.&
graphEntity.properties.encryptionInTransit	asset.assetDetail.typedAttributes.&
graphEntity.properties.externalId	asset.assetHeader.externalAssetId
graphEntity.properties._vertexID	asset.assetHeader.vendorAssetId
graphEntity.properties.isPublic	asset.assetDetail.typedAttributes.&
graphEntity.properties.loggingEnabled	asset.assetDetail.typedAttributes.&
graphEntity.properties.name	asset.assetDetail.name
graphEntity.properties.publicExposure	asset.assetDetail.typedAttributes.&
graphEntity.properties.region	asset.assetDetail.cloudInfo.region
graphEntity.properties.retentionPeriod	asset.assetDetail.typedAttributes.&
FUNCTION_PICKER	asset.assetHeader.status
graphEntity.properties.updatedAt	asset.assetDetail.sourceUpdatedAt
graphEntity.properties.versioningEnabled	asset.assetDetail.typedAttributes.&
graphEntity.properties.webHostingEnabled	asset.assetDetail.typedAttributes.&
graphEntity.properties.zone	asset.assetDetail.cloudInfo.availabilityZone
cloudAccount.id	asset.assetDetail.cloudInfo.accountId
cloudAccount.name	asset.assetDetail.cloudInfo.accountName
tags[].key	asset.assetDetail.externalTags[].key
tags[].value	asset.assetDetail.externalTags[].value
deletedAt	asset.assetDetail.sourceDeletedAt
isOpenToAllInternet	asset.assetDetail.typedAttributes.&
isAccessibleFromInternet	asset.assetDetail.typedAttributes.&
hasAccessToSensitiveData	asset.assetDetail.typedAttributes.&
hasAdminPrivileges	asset.assetDetail.typedAttributes.&
hasHighPrivileges	asset.assetDetail.typedAttributes.&
hasSensitiveData	asset.assetDetail.typedAttributes.&

OCI.BUCKET.OBJECTSTORAGEBUCKET

sourceField	targetField
graphEntity.properties.accessibleFrom.internet	asset.assetDetail.typedAttributes.&
graphEntity.properties.atRestEncryption	asset.assetDetail.typedAttributes.&
graphEntity.properties.cloudPlatform	asset.assetDetail.cloudInfo.provider
graphEntity.properties.cloudProviderURL	asset.assetDetail.cloudInfo.providerUrl
graphEntity.properties.creationDate	asset.assetDetail.sourceCreatedAt
graphEntity.properties.encryptedAtRest	asset.assetDetail.typedAttributes.&
graphEntity.properties.encryptionInTransit	asset.assetDetail.typedAttributes.&
graphEntity.properties.externalId	asset.assetHeader.externalAssetId
graphEntity.properties._vertexID	asset.assetHeader.vendorAssetId
graphEntity.properties.isPublic	asset.assetDetail.typedAttributes.&
graphEntity.properties.loggingEnabled	asset.assetDetail.typedAttributes.&
graphEntity.properties.name	asset.assetDetail.name
graphEntity.properties.publicExposure	asset.assetDetail.typedAttributes.&
graphEntity.properties.region	asset.assetDetail.cloudInfo.region
graphEntity.properties.retentionPeriod	asset.assetDetail.typedAttributes.&
FUNCTION_PICKER	asset.assetHeader.status
graphEntity.properties.updatedAt	asset.assetDetail.sourceUpdatedAt
graphEntity.properties.versioningEnabled	asset.assetDetail.typedAttributes.&
graphEntity.properties.webHostingEnabled	asset.assetDetail.typedAttributes.&
graphEntity.properties.zone	asset.assetDetail.cloudInfo.availabilityZone
cloudAccount.id	asset.assetDetail.cloudInfo.accountId
cloudAccount.name	asset.assetDetail.cloudInfo.accountName
tags[].key	asset.assetDetail.externalTags[].key
tags[].value	asset.assetDetail.externalTags[].value
deletedAt	asset.assetDetail.sourceDeletedAt
isOpenToAllInternet	asset.assetDetail.typedAttributes.&
isAccessibleFromInternet	asset.assetDetail.typedAttributes.&
hasAccessToSensitiveData	asset.assetDetail.typedAttributes.&
hasAdminPrivileges	asset.assetDetail.typedAttributes.&
hasHighPrivileges	asset.assetDetail.typedAttributes.&
hasSensitiveData	asset.assetDetail.typedAttributes.&

AZURE.STORAGEACCOUNT.STORAGEACCOUNTS

sourceField	targetField
graphEntity.properties.accessibleFrom.internet	asset.assetDetail.typedAttributes.&
graphEntity.properties.atRestEncryption	asset.assetDetail.typedAttributes.&
graphEntity.properties.cloudPlatform	asset.assetDetail.cloudInfo.provider
graphEntity.properties.cloudProviderURL	asset.assetDetail.cloudInfo.providerUrl
graphEntity.properties.creationDate	asset.assetDetail.sourceCreatedAt
graphEntity.properties.encryptedAtRest	asset.assetDetail.typedAttributes.&
graphEntity.properties.encryptionInTransit	asset.assetDetail.typedAttributes.&
graphEntity.properties.externalId	asset.assetHeader.externalAssetId
graphEntity.properties._vertexID	asset.assetHeader.vendorAssetId
graphEntity.properties.isPublic	asset.assetDetail.typedAttributes.&
graphEntity.properties.loggingEnabled	asset.assetDetail.typedAttributes.&
graphEntity.properties.name	asset.assetDetail.name
graphEntity.properties.publicExposure	asset.assetDetail.typedAttributes.&
graphEntity.properties.region	asset.assetDetail.cloudInfo.region
graphEntity.properties.retentionPeriod	asset.assetDetail.typedAttributes.&
FUNCTION_PICKER	asset.assetHeader.status
graphEntity.properties.updatedAt	asset.assetDetail.sourceUpdatedAt
graphEntity.properties.versioningEnabled	asset.assetDetail.typedAttributes.&
graphEntity.properties.webHostingEnabled	asset.assetDetail.typedAttributes.&
graphEntity.properties.zone	asset.assetDetail.cloudInfo.availabilityZone
cloudAccount.id	asset.assetDetail.cloudInfo.accountId
cloudAccount.name	asset.assetDetail.cloudInfo.accountName
tags[].key	asset.assetDetail.externalTags[].key
tags[].value	asset.assetDetail.externalTags[].value
deletedAt	asset.assetDetail.sourceDeletedAt
isOpenToAllInternet	asset.assetDetail.typedAttributes.&
isAccessibleFromInternet	asset.assetDetail.typedAttributes.&
hasAccessToSensitiveData	asset.assetDetail.typedAttributes.&
hasAdminPrivileges	asset.assetDetail.typedAttributes.&
hasHighPrivileges	asset.assetDetail.typedAttributes.&
hasSensitiveData	asset.assetDetail.typedAttributes.&

continer_image

AWS.IMAGE

sourceField	targetField
graphEntity.properties._vertexID	asset.assetHeader.vendorAssetId
graphEntity.properties.architecture	asset.assetDetail.containerImageAssetClass.architecture
graphEntity.properties.cloudPlatform	asset.assetDetail.cloudInfo.provider
graphEntity.properties.cloudProviderURL	asset.assetDetail.cloudInfo.providerUrl
graphEntity.properties.imageTags	asset.assetDetail.containerImageAssetClass.tag
graphEntity.properties.containerImageLayers[].layerID	asset.assetDetail.containerImageAssetClass.layer[].digest
image.registry	asset.assetDetail.containerImageAssetClass.registry
imageRepository	asset.assetDetail.containerImageAssetClass.repository
imageName	asset.assetDetail.containerImageAssetClass.name
graphEntity.properties.digest	asset.assetDetail.containerImageAssetClass.digest
evalExternalId	asset.assetHeader.externalAssetId
imageName	asset.assetDetail.name
graphEntity.properties.region	asset.assetDetail.cloudInfo.region
FUNCTION_PICKER	asset.assetHeader.status
createdAt	asset.assetDetail.sourceCreatedAt
graphEntity.properties.updatedAt	asset.assetDetail.sourceUpdatedAt
graphEntity.properties.zone	asset.assetDetail.cloudInfo.availabilityZone
cloudAccount.id	asset.assetDetail.cloudInfo.accountId
cloudAccount.name	asset.assetDetail.cloudInfo.accountName
tags[].key	asset.assetDetail.externalTags[].key
tags[].value	asset.assetDetail.externalTags[].value
deletedAt	asset.assetDetail.sourceDeletedAt
isOpenToAllInternet	asset.assetDetail.typedAttributes.&
isAccessibleFromInternet	asset.assetDetail.typedAttributes.&
hasAccessToSensitiveData	asset.assetDetail.typedAttributes.&
hasAdminPrivileges	asset.assetDetail.typedAttributes.&
hasHighPrivileges	asset.assetDetail.typedAttributes.&
hasSensitiveData	asset.assetDetail.typedAttributes.&

GCP.ARTIFACTREGISTRYDOCKERIMAGE

sourceField	targetField
graphEntity.properties._vertexID	asset.assetHeader.vendorAssetId
graphEntity.properties.architecture	asset.assetDetail.containerImageAssetClass.architecture
graphEntity.properties.cloudPlatform	asset.assetDetail.cloudInfo.provider
graphEntity.properties.cloudProviderURL	asset.assetDetail.cloudInfo.providerUrl
graphEntity.properties.imageTags	asset.assetDetail.containerImageAssetClass.tag
graphEntity.properties.containerImageLayers[].layerID	asset.assetDetail.containerImageAssetClass.layer[].digest
image.registry	asset.assetDetail.containerImageAssetClass.registry
imageRepository	asset.assetDetail.containerImageAssetClass.repository
imageName	asset.assetDetail.containerImageAssetClass.name
graphEntity.properties.digest	asset.assetDetail.containerImageAssetClass.digest
evalExternalId	asset.assetHeader.externalAssetId
imageName	asset.assetDetail.name
graphEntity.properties.region	asset.assetDetail.cloudInfo.region
FUNCTION_PICKER	asset.assetHeader.status
createdAt	asset.assetDetail.sourceCreatedAt
graphEntity.properties.updatedAt	asset.assetDetail.sourceUpdatedAt
graphEntity.properties.zone	asset.assetDetail.cloudInfo.availabilityZone
cloudAccount.id	asset.assetDetail.cloudInfo.accountId
cloudAccount.name	asset.assetDetail.cloudInfo.accountName
tags[].key	asset.assetDetail.externalTags[].key
tags[].value	asset.assetDetail.externalTags[].value
deletedAt	asset.assetDetail.sourceDeletedAt
isOpenToAllInternet	asset.assetDetail.typedAttributes.&
isAccessibleFromInternet	asset.assetDetail.typedAttributes.&
hasAccessToSensitiveData	asset.assetDetail.typedAttributes.&
hasAdminPrivileges	asset.assetDetail.typedAttributes.&
hasHighPrivileges	asset.assetDetail.typedAttributes.&
hasSensitiveData	asset.assetDetail.typedAttributes.&

AZURE.CONTAINERREGISTRYIMAGE

sourceField	targetField
graphEntity.properties._vertexID	asset.assetHeader.vendorAssetId
graphEntity.properties.architecture	asset.assetDetail.containerImageAssetClass.architecture
graphEntity.properties.cloudPlatform	asset.assetDetail.cloudInfo.provider
graphEntity.properties.cloudProviderURL	asset.assetDetail.cloudInfo.providerUrl
graphEntity.properties.imageTags	asset.assetDetail.containerImageAssetClass.tag
graphEntity.properties.containerImageLayers[].layerID	asset.assetDetail.containerImageAssetClass.layer[].digest
image.registry	asset.assetDetail.containerImageAssetClass.registry
imageRepository	asset.assetDetail.containerImageAssetClass.repository
imageName	asset.assetDetail.containerImageAssetClass.name
graphEntity.properties.digest	asset.assetDetail.containerImageAssetClass.digest
evalExternalId	asset.assetHeader.externalAssetId
imageName	asset.assetDetail.name
graphEntity.properties.region	asset.assetDetail.cloudInfo.region
FUNCTION_PICKER	asset.assetHeader.status
createdAt	asset.assetDetail.sourceCreatedAt
graphEntity.properties.updatedAt	asset.assetDetail.sourceUpdatedAt
graphEntity.properties.zone	asset.assetDetail.cloudInfo.availabilityZone
cloudAccount.id	asset.assetDetail.cloudInfo.accountId
cloudAccount.name	asset.assetDetail.cloudInfo.accountName
tags[].key	asset.assetDetail.externalTags[].key
tags[].value	asset.assetDetail.externalTags[].value
deletedAt	asset.assetDetail.sourceDeletedAt
isOpenToAllInternet	asset.assetDetail.typedAttributes.&
isAccessibleFromInternet	asset.assetDetail.typedAttributes.&
hasAccessToSensitiveData	asset.assetDetail.typedAttributes.&
hasAdminPrivileges	asset.assetDetail.typedAttributes.&
hasHighPrivileges	asset.assetDetail.typedAttributes.&
hasSensitiveData	asset.assetDetail.typedAttributes.&

NULL.HOSTEDCONTAINERIMAGE

sourceField	targetField
graphEntity.properties._vertexID	asset.assetHeader.vendorAssetId
graphEntity.properties.architecture	asset.assetDetail.containerImageAssetClass.architecture
graphEntity.properties.cloudPlatform	asset.assetDetail.cloudInfo.provider
graphEntity.properties.cloudProviderURL	asset.assetDetail.cloudInfo.providerUrl
graphEntity.properties.imageTags	asset.assetDetail.containerImageAssetClass.tag
graphEntity.properties.containerImageLayers[].layerID	asset.assetDetail.containerImageAssetClass.layer[].digest
image.registry	asset.assetDetail.containerImageAssetClass.registry
imageRepository	asset.assetDetail.containerImageAssetClass.repository
imageName	asset.assetDetail.containerImageAssetClass.name
graphEntity.properties.digest	asset.assetDetail.containerImageAssetClass.digest
evalExternalId	asset.assetHeader.externalAssetId
imageName	asset.assetDetail.name
graphEntity.properties.region	asset.assetDetail.cloudInfo.region
FUNCTION_PICKER	asset.assetHeader.status
createdAt	asset.assetDetail.sourceCreatedAt
graphEntity.properties.updatedAt	asset.assetDetail.sourceUpdatedAt
graphEntity.properties.zone	asset.assetDetail.cloudInfo.availabilityZone
cloudAccount.id	asset.assetDetail.cloudInfo.accountId
cloudAccount.name	asset.assetDetail.cloudInfo.accountName
tags[].key	asset.assetDetail.externalTags[].key
tags[].value	asset.assetDetail.externalTags[].value
deletedAt	asset.assetDetail.sourceDeletedAt
isOpenToAllInternet	asset.assetDetail.typedAttributes.&
isAccessibleFromInternet	asset.assetDetail.typedAttributes.&
hasAccessToSensitiveData	asset.assetDetail.typedAttributes.&
hasAdminPrivileges	asset.assetDetail.typedAttributes.&
hasHighPrivileges	asset.assetDetail.typedAttributes.&
hasSensitiveData	asset.assetDetail.typedAttributes.&

CONTAINER_IMAGE

sourceField	targetField
graphEntity.properties._vertexID	asset.assetHeader.vendorAssetId
graphEntity.properties.architecture	asset.assetDetail.containerImageAssetClass.architecture
graphEntity.properties.cloudPlatform	asset.assetDetail.cloudInfo.provider
graphEntity.properties.cloudProviderURL	asset.assetDetail.cloudInfo.providerUrl
graphEntity.properties.imageTags	asset.assetDetail.containerImageAssetClass.tag
graphEntity.properties.containerImageLayers[].layerID	asset.assetDetail.containerImageAssetClass.layer[].digest
image.registry	asset.assetDetail.containerImageAssetClass.registry
imageRepository	asset.assetDetail.containerImageAssetClass.repository
imageName	asset.assetDetail.containerImageAssetClass.name
graphEntity.properties.digest	asset.assetDetail.containerImageAssetClass.digest
evalExternalId	asset.assetHeader.externalAssetId
imageName	asset.assetDetail.name
graphEntity.properties.region	asset.assetDetail.cloudInfo.region
FUNCTION_PICKER	asset.assetHeader.status
createdAt	asset.assetDetail.sourceCreatedAt
graphEntity.properties.updatedAt	asset.assetDetail.sourceUpdatedAt
graphEntity.properties.zone	asset.assetDetail.cloudInfo.availabilityZone
cloudAccount.id	asset.assetDetail.cloudInfo.accountId
cloudAccount.name	asset.assetDetail.cloudInfo.accountName
tags[].key	asset.assetDetail.externalTags[].key
tags[].value	asset.assetDetail.externalTags[].value
deletedAt	asset.assetDetail.sourceDeletedAt
isOpenToAllInternet	asset.assetDetail.typedAttributes.&
isAccessibleFromInternet	asset.assetDetail.typedAttributes.&
hasAccessToSensitiveData	asset.assetDetail.typedAttributes.&
hasAdminPrivileges	asset.assetDetail.typedAttributes.&
hasHighPrivileges	asset.assetDetail.typedAttributes.&
hasSensitiveData	asset.assetDetail.typedAttributes.&

continer_instance

AWS.ECSCONTAINERINSTANCE

sourceField	targetField
graphEntity.properties._vertexID	asset.assetHeader.vendorAssetId
graphEntity.properties.boundPorts[].number	asset.assetDetail.containerInstanceAssetClass.ports[].containerPort
graphEntity.properties.boundPorts[].kubernetes.hostPort	asset.assetDetail.containerInstanceAssetClass.ports[].hostPort
graphEntity.properties.boundPorts[].networkProtocol	asset.assetDetail.containerInstanceAssetClass.ports[].protocol
graphEntity.properties.accessibleFrom.internet	asset.assetDetail.typedAttributes.&
graphEntity.properties.cloudPlatform	asset.assetDetail.cloudInfo.provider
graphEntity.properties.cloudProviderURL	asset.assetDetail.cloudInfo.providerUrl
graphEntity.properties.creationDate	asset.assetDetail.sourceCreatedAt
graphEntity.properties.env.*	asset.assetDetail.containerInstanceAssetClass.environmentVariables.&
image.name	asset.assetDetail.containerInstanceAssetClass.image.name
image.tag	asset.assetDetail.containerInstanceAssetClass.image.tag
image.registry	asset.assetDetail.containerInstanceAssetClass.image.registry
graphEntity.properties.externalId	asset.assetHeader.externalAssetId
graphEntity.properties.name	asset.assetDetail.name
graphEntity.properties.region	asset.assetDetail.cloudInfo.region
FUNCTION_PICKER	asset.assetHeader.status
graphEntity.properties.status	asset.assetDetail.containerInstanceAssetClass.status
graphEntity.properties.updatedAt	asset.assetDetail.sourceUpdatedAt
graphEntity.properties.zone	asset.assetDetail.cloudInfo.availabilityZone
externalId	asset.assetDetail.containerInstanceAssetClass.id
cloudAccount.id	asset.assetDetail.cloudInfo.accountId
cloudAccount.name	asset.assetDetail.cloudInfo.accountName
tags[].key	asset.assetDetail.externalTags[].key
tags[].value	asset.assetDetail.externalTags[].value
deletedAt	asset.assetDetail.sourceDeletedAt
isOpenToAllInternet	asset.assetDetail.typedAttributes.&
isAccessibleFromInternet	asset.assetDetail.typedAttributes.&
hasAccessToSensitiveData	asset.assetDetail.typedAttributes.&
hasAdminPrivileges	asset.assetDetail.typedAttributes.&
hasHighPrivileges	asset.assetDetail.typedAttributes.&
hasSensitiveData	asset.assetDetail.typedAttributes.&

OCI.HOSTEDCONTAINER

sourceField	targetField
graphEntity.properties._vertexID	asset.assetHeader.vendorAssetId
graphEntity.properties.boundPorts[].number	asset.assetDetail.containerInstanceAssetClass.ports[].containerPort
graphEntity.properties.boundPorts[].kubernetes.hostPort	asset.assetDetail.containerInstanceAssetClass.ports[].hostPort
graphEntity.properties.boundPorts[].networkProtocol	asset.assetDetail.containerInstanceAssetClass.ports[].protocol
graphEntity.properties.cloudPlatform	asset.assetDetail.cloudInfo.provider
graphEntity.properties.cloudProviderURL	asset.assetDetail.cloudInfo.providerUrl
graphEntity.properties.creationDate	asset.assetDetail.sourceCreatedAt
image.name	asset.assetDetail.containerInstanceAssetClass.image.name
image.tag	asset.assetDetail.containerInstanceAssetClass.image.tag
image.registry	asset.assetDetail.containerInstanceAssetClass.image.registry
graphEntity.properties.externalId	asset.assetHeader.externalAssetId
graphEntity.properties.name	asset.assetDetail.name
graphEntity.properties.region	asset.assetDetail.cloudInfo.region
FUNCTION_PICKER	asset.assetHeader.status
graphEntity.properties.status	asset.assetDetail.containerInstanceAssetClass.status
graphEntity.properties.updatedAt	asset.assetDetail.sourceUpdatedAt
graphEntity.properties.zone	asset.assetDetail.cloudInfo.availabilityZone
externalId	asset.assetDetail.containerInstanceAssetClass.id
cloudAccount.externalId	asset.assetDetail.cloudInfo.accountId
cloudAccount.name	asset.assetDetail.cloudInfo.accountName
tags[].key	asset.assetDetail.externalTags[].key
tags[].value	asset.assetDetail.externalTags[].value
deletedAt	asset.assetDetail.sourceDeletedAt
isOpenToAllInternet	asset.assetDetail.typedAttributes.&
isAccessibleFromInternet	asset.assetDetail.typedAttributes.&
hasAccessToSensitiveData	asset.assetDetail.typedAttributes.&
hasAdminPrivileges	asset.assetDetail.typedAttributes.&
hasHighPrivileges	asset.assetDetail.typedAttributes.&
hasSensitiveData	asset.assetDetail.typedAttributes.&
graphEntity.properties.env.*	asset.assetDetail.containerInstanceAssetClass.environmentVariables.&

AZURE.CONTAINERAPPS

sourceField	targetField
graphEntity.properties._vertexID	asset.assetHeader.vendorAssetId
graphEntity.properties.boundPorts[].number	asset.assetDetail.containerInstanceAssetClass.ports[].containerPort
graphEntity.properties.boundPorts[].kubernetes.hostPort	asset.assetDetail.containerInstanceAssetClass.ports[].hostPort
graphEntity.properties.boundPorts[].networkProtocol	asset.assetDetail.containerInstanceAssetClass.ports[].protocol
graphEntity.properties.accessibleFrom.internet	asset.assetDetail.typedAttributes.&
graphEntity.properties.cloudPlatform	asset.assetDetail.cloudInfo.provider
graphEntity.properties.cloudProviderURL	asset.assetDetail.cloudInfo.providerUrl
graphEntity.properties.creationDate	asset.assetDetail.sourceCreatedAt
graphEntity.properties.env.*	asset.assetDetail.containerInstanceAssetClass.environmentVariables.&
image.name	asset.assetDetail.containerInstanceAssetClass.image.name
image.tag	asset.assetDetail.containerInstanceAssetClass.image.tag
image.registry	asset.assetDetail.containerInstanceAssetClass.image.registry
graphEntity.properties.externalId	asset.assetHeader.externalAssetId
graphEntity.properties.name	asset.assetDetail.name
graphEntity.properties.region	asset.assetDetail.cloudInfo.region
graphEntity.properties.status	asset.assetHeader.status

AWS.HOSTEDCONTAINER

sourceField	targetField
graphEntity.properties._vertexID	asset.assetHeader.vendorAssetId
graphEntity.properties.boundPorts[].number	asset.assetDetail.containerInstanceAssetClass.ports[].containerPort
graphEntity.properties.boundPorts[].kubernetes.hostPort	asset.assetDetail.containerInstanceAssetClass.ports[].hostPort
graphEntity.properties.boundPorts[].networkProtocol	asset.assetDetail.containerInstanceAssetClass.ports[].protocol
graphEntity.properties.cloudPlatform	asset.assetDetail.cloudInfo.provider
graphEntity.properties.cloudProviderURL	asset.assetDetail.cloudInfo.providerUrl
graphEntity.properties.creationDate	asset.assetDetail.sourceCreatedAt
graphEntity.properties.env.*	asset.assetDetail.containerInstanceAssetClass.environmentVariables.&
image.name	asset.assetDetail.containerInstanceAssetClass.image.name
image.tag	asset.assetDetail.containerInstanceAssetClass.image.tag
image.registry	asset.assetDetail.containerInstanceAssetClass.image.registry
graphEntity.properties.externalId	asset.assetHeader.externalAssetId
graphEntity.properties.name	asset.assetDetail.name
graphEntity.properties.region	asset.assetDetail.cloudInfo.region

 

KUBERNETES.CONTAINERRESOURCE

sourceField	targetField
graphEntity.properties._vertexID	asset.assetHeader.vendorAssetId
graphEntity.properties.accessibleFrom.internet	asset.assetDetail.typedAttributes.&
graphEntity.properties.cloudPlatform	asset.assetDetail.cloudInfo.provider
graphEntity.properties.cloudProviderURL	asset.assetDetail.cloudInfo.providerUrl
graphEntity.properties.creationDate	asset.assetDetail.sourceCreatedAt
graphEntity.properties.env.*	asset.assetDetail.containerInstanceAssetClass.environmentVariables.&
graphEntity.properties.boundPorts[].number	asset.assetDetail.containerInstanceAssetClass.ports[].containerPort
graphEntity.properties.boundPorts[].kubernetes.hostPort	asset.assetDetail.containerInstanceAssetClass.ports[].hostPort
graphEntity.properties.boundPorts[].networkProtocol	asset.assetDetail.containerInstanceAssetClass.ports[].protocol
image.name	asset.assetDetail.containerInstanceAssetClass.image.name
image.tag	asset.assetDetail.containerInstanceAssetClass.image.tag
image.registry	asset.assetDetail.containerInstanceAssetClass.image.registry
graphEntity.properties.externalId	asset.assetHeader.externalAssetId

Vunerability
VIRTUAL_MACHINE

sourceField	targetField
vulnerableAsset.name	asset.assetDetail.computeAssetClass.cloudInstance.hostname
vulnerableAsset.name	asset.assetDetail.network[].hostname
vulnerableAsset.ipAddresses[]	asset.assetDetail.network[].ipv4Addresses[]
vulnerableAsset.externalId	asset.assetHeader.externalAssetId
vulnerableAsset.status	asset.assetHeader.status
vulnerableAsset.id	asset.assetHeader.vendorAssetId
vulnerableAsset.name	asset.assetDetail.name
vulnerableAsset.name	asset.assetDetail.hostIdentity.hostname
id	findingGroup.findings[].externalFindingId
portalUrl	findingGroup.findings[].findingURL
name	findingGroup.findings[].findingType.vulnerability.cveId
CVEDescription	findingGroup.findings[].description
status	findingGroup.findings[].findingStatus
severity	findingGroup.findings[].severity
firstDetectedAt	findingGroup.findings[].firstFoundOn
lastDetectedAt	findingGroup.findings[].lastFoundOn
resolvedAt	findingGroup.findings[].lastFixedOn
remediation	findingGroup.findings[].remediation.remediationStrategy
name	findingGroup.findings[].name
detailedName	findingGroup.findings[].product.name
version	findingGroup.findings[].product.version
detectionMethod	findingGroup.findings[].detectionMethod
hasExploit	findingGroup.findings[].findingType.vulnerability.isExploitAvailable
link	findingGroup.findings[].findingDetectionURL
cvssv3.attackVector	findingGroup.findings[].findingType.vulnerability.cvss.vector

AWS.VIRTUAL_MACHINE

sourceField	targetField
vulnerableAsset.name	asset.assetDetail.computeAssetClass.cloudInstance.hostname
vulnerableAsset.name	asset.assetDetail.network[].hostname
vulnerableAsset.ipAddresses[]	asset.assetDetail.network[].ipv4Addresses[]
vulnerableAsset.providerUniqueId	asset.assetHeader.externalAssetId
vulnerableAsset.status	asset.assetHeader.status
vulnerableAsset.id	asset.assetHeader.vendorAssetId
vulnerableAsset.name	asset.assetDetail.name
vulnerableAsset.name	asset.assetDetail.hostIdentity.hostname
id	findingGroup.findings[].externalFindingId
portalUrl	findingGroup.findings[].findingURL
name	findingGroup.findings[].findingType.vulnerability.cveId
CVEDescription	findingGroup.findings[].description
status	findingGroup.findings[].findingStatus
severity	findingGroup.findings[].severity
firstDetectedAt	findingGroup.findings[].firstFoundOn
lastDetectedAt	findingGroup.findings[].lastFoundOn
resolvedAt	findingGroup.findings[].lastFixedOn
remediation	findingGroup.findings[].remediation.remediationStrategy
name	findingGroup.findings[].name
detailedName	findingGroup.findings[].product.name
version	findingGroup.findings[].product.version
detectionMethod	findingGroup.findings[].detectionMethod
hasExploit	findingGroup.findings[].findingType.vulnerability.isExploitAvailable
link	findingGroup.findings[].findingDetectionURL
cvssv3.attackVector	findingGroup.findings[].findingType.vulnerability.cvss.vector

AWS.BUCKET

sourceField	targetField
vulnerableAsset.providerUniqueId	asset.assetHeader.externalAssetId
vulnerableAsset.status	asset.assetHeader.status
vulnerableAsset.id	asset.assetHeader.vendorAssetId
vulnerableAsset.name	asset.assetDetail.name
vulnerableAsset.name	asset.assetDetail.hostIdentity.hostname
id	findingGroup.findings[].externalFindingId
portalUrl	findingGroup.findings[].findingURL
name	findingGroup.findings[].findingType.vulnerability.cweId
CVEDescription	findingGroup.findings[].description
status	findingGroup.findings[].findingStatus
severity	findingGroup.findings[].severity
firstDetectedAt	findingGroup.findings[].firstFoundOn
lastDetectedAt	findingGroup.findings[].lastFoundOn
resolvedAt	findingGroup.findings[].lastFixedOn
remediation	findingGroup.findings[].remediation.remediationStrategy
name	findingGroup.findings[].name
detailedName	findingGroup.findings[].product.name
version	findingGroup.findings[].product.version
detectionMethod	findingGroup.findings[].detectionMethod
hasExploit	findingGroup.findings[].findingType.vulnerability.isExploitAvailable
link	findingGroup.findings[].findingDetectionURL
cvssv3.attackVector	findingGroup.findings[].findingType.vulnerability.cvss.vector

ALL.AWS

sourceField	targetField
vulnerableAsset.providerUniqueId	asset.assetHeader.externalAssetId
vulnerableAsset.status	asset.assetHeader.status
vulnerableAsset.id	asset.assetHeader.vendorAssetId
vulnerableAsset.name	asset.assetDetail.name
vulnerableAsset.name	asset.assetDetail.hostIdentity.hostname
id	findingGroup.findings[].externalFindingId
portalUrl	findingGroup.findings[].findingURL
name	findingGroup.findings[].findingType.vulnerability.cveId
CVEDescription	findingGroup.findings[].description
status	findingGroup.findings[].findingStatus
severity	findingGroup.findings[].severity
firstDetectedAt	findingGroup.findings[].firstFoundOn
lastDetectedAt	findingGroup.findings[].lastFoundOn
resolvedAt	findingGroup.findings[].lastFixedOn
remediation	findingGroup.findings[].remediation.remediationStrategy
name	findingGroup.findings[].name
detailedName	findingGroup.findings[].product.name
version	findingGroup.findings[].product.version
detectionMethod	findingGroup.findings[].detectionMethod
hasExploit	findingGroup.findings[].findingType.vulnerability.isExploitAvailable
link	findingGroup.findings[].findingDetectionURL
cvssv3.attackVector	findingGroup.findings[].findingType.vulnerability.cvss.vector

ALL
 

sourceField	targetField
vulnerableAsset.externalId	asset.assetHeader.externalAssetId
vulnerableAsset.status	asset.assetHeader.status
vulnerableAsset.id	asset.assetHeader.vendorAssetId
vulnerableAsset.name	asset.assetDetail.name
vulnerableAsset.name	asset.assetDetail.hostIdentity.hostname
id	findingGroup.findings[].externalFindingId
portalUrl	findingGroup.findings[].findingURL
name	findingGroup.findings[].findingType.vulnerability.cveId
CVEDescription	findingGroup.findings[].description
status	findingGroup.findings[].findingStatus
severity	findingGroup.findings[].severity
firstDetectedAt	findingGroup.findings[].firstFoundOn
lastDetectedAt	findingGroup.findings[].lastFoundOn
resolvedAt	findingGroup.findings[].lastFixedOn
remediation	findingGroup.findings[].remediation.remediationStrategy
name	findingGroup.findings[].name
detailedName	findingGroup.findings[].product.name
version	findingGroup.findings[].product.version
detectionMethod	findingGroup.findings[].detectionMethod
hasExploit	findingGroup.findings[].findingType.vulnerability.isExploitAvailable
link	findingGroup.findings[].findingDetectionURL
cvssv3.attackVector	findingGroup.findings[].findingType.vulnerability.cvss.vector

CONTAINER_IMAGE

sourceField	targetField
vulnerableAsset.name	asset.assetDetail.computeAssetClass.containerImage.name
vulnerableAsset.name	asset.assetDetail.computeAssetClass.containerImage.repository
vulnerableAsset.name	asset.assetDetail.computeAssetClass.containerImage.tag
vulnerableAsset.id	asset.assetDetail.computeAssetClass.containerImage.id
vulnerableAsset.name	asset.assetDetail.computeAssetClass.containerImage.fullPath
vulnerableAsset.externalId	asset.assetDetail.computeAssetClass.containerImage.externalId
vulnerableAsset.externalId	asset.assetHeader.externalAssetId
vulnerableAsset.status	asset.assetHeader.status
vulnerableAsset.id	asset.assetHeader.vendorAssetId
vulnerableAsset.name	asset.assetDetail.name
vulnerableAsset.name	asset.assetDetail.hostIdentity.hostname
id	findingGroup.findings[].externalFindingId
portalUrl	findingGroup.findings[].findingURL
name	findingGroup.findings[].findingType.vulnerability.cveId
CVEDescription	findingGroup.findings[].description
status	findingGroup.findings[].findingStatus
severity	findingGroup.findings[].severity
firstDetectedAt	findingGroup.findings[].firstFoundOn
lastDetectedAt	findingGroup.findings[].lastFoundOn
resolvedAt	findingGroup.findings[].lastFixedOn
remediation	findingGroup.findings[].remediation.remediationStrategy
name	findingGroup.findings[].name
detailedName	findingGroup.findings[].product.name
version	findingGroup.findings[].product.version
detectionMethod	findingGroup.findings[].detectionMethod
hasExploit	findingGroup.findings[].findingType.vulnerability.isExploitAvailable
link	findingGroup.findings[].findingDetectionURL
cvssv3.attackVector	findingGroup.findings[].findingType.vulnerability.cvss.vector

 

MISCONFIGURATION - ALL

 

asset_root (assetType)	asset.assetHeader.assetTypeName
resource.id	asset.assetHeader.externalAssetId
resource.id	asset.assetHeader.vendorAssetId
resource.name	asset.assetDetail.name
id	findingGroup.findings[].externalFindingId
rule.name	findingGroup.findings[].name
rule.description	findingGroup.findings[].description
result	findingGroup.findings[].findingStatus
severity	findingGroup.findings[].severity
resource.subscription.cloudProvider	findingGroup.findings[].vendorName
firstSeenAt	findingGroup.findings[].firstFoundOn
result	findingGroup.findings[].detectionResult
remediation	findingGroup.findings[].solutionRecommendation
rule.remediationInstructions	findingGroup.findings[].remediation.description
rule.name	findingGroup.findings[].findingType.misconfiguration.rule.ruleName
rule.description	findingGroup.findings[].findingType.misconfiguration.rule.ruleDescription
rule.shortId	findingGroup.findings[].findingType.misconfiguration.control.id

MISCONFIGURATION - VIRTUAL_MACHINE

 

asset_root (assetType)	asset.assetHeader.assetTypeName
resource.name	asset.assetDetail.hostIdentity.hostname
resource.id	asset.assetHeader.externalAssetId
resource.id	asset.assetHeader.vendorAssetId
resource.name	asset.assetDetail.name
id	findingGroup.findings[].externalFindingId
rule.name	findingGroup.findings[].name
rule.description	findingGroup.findings[].description
result	findingGroup.findings[].findingStatus
severity	findingGroup.findings[].severity
resource.subscription.cloudProvider	findingGroup.findings[].vendorName
firstSeenAt	findingGroup.findings[].firstFoundOn
result	findingGroup.findings[].detectionResult
remediation	findingGroup.findings[].solutionRecommendation
rule.remediationInstructions	findingGroup.findings[].remediation.remediationStrategy
rule.functionAsControl	findingGroup.findings[].remediation.description
rule.name	findingGroup.findings[].findingType.misconfiguration.rule.ruleName
rule.description	findingGroup.findings[].findingType.misconfiguration.rule.ruleDescription
rule.shortId	findingGroup.findings[].findingType.misconfiguration.control.id

 

AWS Lambda Function

 

graphEntity.properties.externalId	asset.assetHeader.externalAssetId
graphEntity.properties._vertexID	asset.assetHeader.vendorAssetId
graphEntity.properties.name	asset.assetDetail.name
cloudAccount.id	asset.assetDetail.cloudInfo.accountId
cloudAccount.name	asset.assetDetail.cloudInfo.accountName
graphEntity.properties.cloudPlatform	asset.assetDetail.cloudInfo.provider
graphEntity.properties.cloudProviderURL	asset.assetDetail.cloudInfo.providerUrl
graphEntity.properties.region	asset.assetDetail.cloudInfo.region
graphEntity.properties.zone	asset.assetDetail.cloudInfo.availabilityZone
graphEntity.properties.nativeType	asset.assetDetail.serverlessAssetClass.serviceName
graphEntity.properties.name	asset.assetDetail.serverlessAssetClass.functionName
graphEntity.properties.runtime	asset.assetDetail.serverlessAssetClass.runtime
graphEntity.properties.awsLambda_codeSha256	asset.assetDetail.serverlessAssetClass.codeSha256
graphEntity.properties.awsLambda_version	asset.assetDetail.serverlessAssetClass.version
graphEntity.properties.awsLambda_isLatestVersion	asset.assetDetail.typedAttributes.&
graphEntity.properties.status	asset.assetHeader.status
graphEntity.properties.creationDate	asset.assetDetail.sourceCreatedAt
graphEntity.properties.updatedAt	asset.assetDetail.sourceUpdatedAt
graphEntity.properties.deletedAt	asset.assetDetail.sourceDeletedAt
isOpenToAllInternet	asset.assetDetail.typedAttributes.&
isAccessibleFromInternet	asset.assetDetail.typedAttributes.&
hasSensitiveData	asset.assetDetail.typedAttributes.&
hasAdminPrivileges	asset.assetDetail.typedAttributes.&
hasHighPrivileges	asset.assetDetail.typedAttributes.&
hasAccessToSensitiveData	asset.assetDetail.typedAttributes.&
tags[].key	asset.assetDetail.externalTags[].key
tags[].value	asset.assetDetail.externalTags[].value
CONSTANT: "aws-lambda-function"	asset.assetHeader.assetTypeName

Azure Function

 

graphEntity.properties.externalId	asset.assetHeader.externalAssetId
graphEntity.properties._vertexID	asset.assetHeader.vendorAssetId
graphEntity.properties.name	asset.assetDetail.name
graphEntity.properties.creationDate	asset.assetDetail.sourceCreatedAt
graphEntity.properties.deletedAt	asset.assetDetail.sourceDeletedAt
cloudAccount.id	asset.assetDetail.cloudInfo.accountId
cloudAccount.name	asset.assetDetail.cloudInfo.accountName
graphEntity.properties.cloudPlatform	asset.assetDetail.cloudInfo.provider
graphEntity.properties.cloudProviderURL	asset.assetDetail.cloudInfo.providerUrl
graphEntity.properties.region	asset.assetDetail.cloudInfo.region
graphEntity.properties.zone	asset.assetDetail.cloudInfo.availabilityZone
graphEntity.properties.nativeType	asset.assetDetail.serverlessAssetClass.serviceName
graphEntity.properties.name	asset.assetDetail.serverlessAssetClass.functionName
graphEntity.properties.runtime	asset.assetDetail.serverlessAssetClass.runtime
graphEntity.properties.status	asset.assetHeader.status
graphEntity.properties.updatedAt	asset.assetDetail.sourceUpdatedAt
isOpenToAllInternet	asset.assetDetail.typedAttributes.&
isAccessibleFromInternet	asset.assetDetail.typedAttributes.&
hasSensitiveData	asset.assetDetail.typedAttributes.&
hasAdminPrivileges	asset.assetDetail.typedAttributes.&
hasHighPrivileges	asset.assetDetail.typedAttributes.&
hasAccessToSensitiveData	asset.assetDetail.typedAttributes.&
tags[].key	asset.assetDetail.externalTags[].key
tags[].value	asset.assetDetail.externalTags[].value
CONSTANT: "azure-function"	asset.assetHeader.assetTypeName

GCP Cloud Function

 

graphEntity.properties.externalId	asset.assetHeader.externalAssetId
graphEntity.properties._vertexID	asset.assetHeader.vendorAssetId
graphEntity.properties.name	asset.assetDetail.name
graphEntity.properties.creationDate	asset.assetDetail.sourceCreatedAt
graphEntity.properties.deletedAt	asset.assetDetail.sourceDeletedAt
cloudAccount.id	asset.assetDetail.cloudInfo.accountId
cloudAccount.name	asset.assetDetail.cloudInfo.accountName
graphEntity.properties.cloudPlatform	asset.assetDetail.cloudInfo.provider
graphEntity.properties.cloudProviderURL	asset.assetDetail.cloudInfo.providerUrl
graphEntity.properties.region	asset.assetDetail.cloudInfo.region
graphEntity.properties.zone	asset.assetDetail.cloudInfo.availabilityZone
graphEntity.properties.nativeType	asset.assetDetail.serverlessAssetClass.serviceName
graphEntity.properties.name	asset.assetDetail.serverlessAssetClass.functionName
graphEntity.properties.runtime	asset.assetDetail.serverlessAssetClass.runtime
graphEntity.properties.status	asset.assetHeader.status
graphEntity.properties.updatedAt	asset.assetDetail.sourceUpdatedAt
isOpenToAllInternet	asset.assetDetail.typedAttributes.&
isAccessibleFromInternet	asset.assetDetail.typedAttributes.&
hasSensitiveData	asset.assetDetail.typedAttributes.&
hasAdminPrivileges	asset.assetDetail.typedAttributes.&
hasHighPrivileges	asset.assetDetail.typedAttributes.&
hasAccessToSensitiveData	asset.assetDetail.typedAttributes.&
tags[].key	asset.assetDetail.externalTags[].key
tags[].value	asset.assetDetail.externalTags[].value
CONSTANT: "gcp-cloud-function"	asset.assetHeader.assetTypeName

OCI Function

 

graphEntity.properties.externalId	asset.assetHeader.externalAssetId
graphEntity.properties._vertexID	asset.assetHeader.vendorAssetId
graphEntity.properties.accessibleFrom.internet	asset.assetDetail.typedAttributes.&
graphEntity.properties.name	asset.assetDetail.name
cloudAccount.id	asset.assetDetail.cloudInfo.accountId
cloudAccount.name	asset.assetDetail.cloudInfo.accountName
graphEntity.properties.cloudPlatform	asset.assetDetail.cloudInfo.provider
graphEntity.properties.cloudProviderURL	asset.assetDetail.cloudInfo.providerUrl
graphEntity.properties.region	asset.assetDetail.cloudInfo.region
graphEntity.properties.zone	asset.assetDetail.cloudInfo.availabilityZone
graphEntity.properties.nativeType	asset.assetDetail.serverlessAssetClass.serviceName
graphEntity.properties.name	asset.assetDetail.serverlessAssetClass.functionName
graphEntity.properties.runtime	asset.assetDetail.serverlessAssetClass.runtime
graphEntity.properties.creationDate	asset.assetDetail.sourceCreatedAt
graphEntity.properties.updatedAt	asset.assetDetail.sourceUpdatedAt
graphEntity.properties.deletedAt	asset.assetDetail.sourceDeletedAt
graphEntity.properties.status	asset.assetHeader.status
isOpenToAllInternet	asset.assetDetail.typedAttributes.&
isAccessibleFromInternet	asset.assetDetail.typedAttributes.&
hasAccessToSensitiveData	asset.assetDetail.typedAttributes.&
hasSensitiveData	asset.assetDetail.typedAttributes.&
hasAdminPrivileges	asset.assetDetail.typedAttributes.&
hasHighPrivileges	asset.assetDetail.typedAttributes.&
tags[].key	asset.assetDetail.externalTags[].key
tags[].value	asset.assetDetail.externalTags[].value
CONSTANT: "oci-function"	asset.assetHeader.assetTypeName

 

 

Wiz Vulnerability Field Mapping

VULNERABILITY - VIRTUAL_MACHINE

 

asset_root (assetType)	asset.assetHeader.assetTypeName
vulnerableAsset.name	asset.assetDetail.computeAssetClass.cloudInstance.hostname
vulnerableAsset.name	asset.assetDetail.network[].hostname
vulnerableAsset.ipAddresses[]	asset.assetDetail.network[].ipv4Addresses[]
vulnerableAsset.externalId	asset.assetHeader.externalAssetId
vulnerableAsset.status	asset.assetHeader.status
vulnerableAsset.id	asset.assetHeader.vendorAssetId
vulnerableAsset.name	asset.assetDetail.name
vulnerableAsset.name	asset.assetDetail.hostIdentity.hostname
id	findingGroup.findings[].externalFindingId
portalUrl	findingGroup.findings[].findingURL
name	findingGroup.findings[].findingType.vulnerability.cveId
CVEDescription	findingGroup.findings[].description
status	findingGroup.findings[].findingStatus
severity	findingGroup.findings[].severity
firstDetectedAt	findingGroup.findings[].firstFoundOn
lastDetectedAt	findingGroup.findings[].lastFoundOn
resolvedAt	findingGroup.findings[].lastFixedOn
remediation	findingGroup.findings[].remediation.remediationStrategy
name	findingGroup.findings[].name
detailedName	findingGroup.findings[].product.name
version	findingGroup.findings[].product.version
detectionMethod	findingGroup.findings[].detectionMethod
hasExploit	findingGroup.findings[].findingType.vulnerability.isExploitAvailable
link	findingGroup.findings[].findingDetectionURL
cvssv3.attackVector	findingGroup.findings[].findingType.vulnerability.cvss.vector

VULNERABILITY - AWS.VIRTUAL_MACHINE

 

asset_root (assetType)	asset.assetHeader.assetTypeName
vulnerableAsset.name	asset.assetDetail.computeAssetClass.cloudInstance.hostname
vulnerableAsset.name	asset.assetDetail.network[].hostname
vulnerableAsset.ipAddresses[]	asset.assetDetail.network[].ipv4Addresses[]
vulnerableAsset.providerUniqueId	asset.assetHeader.externalAssetId
vulnerableAsset.status	asset.assetHeader.status
vulnerableAsset.id	asset.assetHeader.vendorAssetId
vulnerableAsset.name	asset.assetDetail.name
vulnerableAsset.name	asset.assetDetail.hostIdentity.hostname
id	findingGroup.findings[].externalFindingId
portalUrl	findingGroup.findings[].findingURL
name	findingGroup.findings[].findingType.vulnerability.cveId
CVEDescription	findingGroup.findings[].description
status	findingGroup.findings[].findingStatus
severity	findingGroup.findings[].severity
firstDetectedAt	findingGroup.findings[].firstFoundOn
lastDetectedAt	findingGroup.findings[].lastFoundOn
resolvedAt	findingGroup.findings[].lastFixedOn
remediation	findingGroup.findings[].remediation.remediationStrategy
name	findingGroup.findings[].name
detailedName	findingGroup.findings[].product.name
version	findingGroup.findings[].product.version
detectionMethod	findingGroup.findings[].detectionMethod
hasExploit	findingGroup.findings[].findingType.vulnerability.isExploitAvailable
link	findingGroup.findings[].findingDetectionURL
cvssv3.attackVector	findingGroup.findings[].findingType.vulnerability.cvss.vector

VULNERABILITY - AWS.BUCKET

 

asset_root (assetType)	asset.assetHeader.assetTypeName
vulnerableAsset.providerUniqueId	asset.assetHeader.externalAssetId
vulnerableAsset.status	asset.assetHeader.status
vulnerableAsset.id	asset.assetHeader.vendorAssetId
vulnerableAsset.name	asset.assetDetail.name
vulnerableAsset.name	asset.assetDetail.hostIdentity.hostname
id	findingGroup.findings[].externalFindingId
portalUrl	findingGroup.findings[].findingURL
name	findingGroup.findings[].findingType.vulnerability.cweId
CVEDescription	findingGroup.findings[].description
status	findingGroup.findings[].findingStatus
severity	findingGroup.findings[].severity
firstDetectedAt	findingGroup.findings[].firstFoundOn
lastDetectedAt	findingGroup.findings[].lastFoundOn
resolvedAt	findingGroup.findings[].lastFixedOn
remediation	findingGroup.findings[].remediation.remediationStrategy
name	findingGroup.findings[].name
detailedName	findingGroup.findings[].product.name
version	findingGroup.findings[].product.version
detectionMethod	findingGroup.findings[].detectionMethod
hasExploit	findingGroup.findings[].findingType.vulnerability.isExploitAvailable
link	findingGroup.findings[].findingDetectionURL
cvssv3.attackVector	findingGroup.findings[].findingType.vulnerability.cvss.vector

VULNERABILITY - ALL.AWS

 

asset_root (assetType)	asset.assetHeader.assetTypeName
vulnerableAsset.providerUniqueId	asset.assetHeader.externalAssetId
vulnerableAsset.status	asset.assetHeader.status
vulnerableAsset.id	asset.assetHeader.vendorAssetId
vulnerableAsset.name	asset.assetDetail.name
vulnerableAsset.name	asset.assetDetail.hostIdentity.hostname
id	findingGroup.findings[].externalFindingId
portalUrl	findingGroup.findings[].findingURL
name	findingGroup.findings[].findingType.vulnerability.cveId
CVEDescription	findingGroup.findings[].description
status	findingGroup.findings[].findingStatus
severity	findingGroup.findings[].severity
firstDetectedAt	findingGroup.findings[].firstFoundOn
lastDetectedAt	findingGroup.findings[].lastFoundOn
resolvedAt	findingGroup.findings[].lastFixedOn
remediation	findingGroup.findings[].remediation.remediationStrategy
name	findingGroup.findings[].name
detailedName	findingGroup.findings[].product.name
version	findingGroup.findings[].product.version
detectionMethod	findingGroup.findings[].detectionMethod
hasExploit	findingGroup.findings[].findingType.vulnerability.isExploitAvailable
link	findingGroup.findings[].findingDetectionURL
cvssv3.attackVector	findingGroup.findings[].findingType.vulnerability.cvss.vector

VULNERABILITY - ALL

 

asset_root (assetType)	asset.assetHeader.assetTypeName
vulnerableAsset.externalId	asset.assetHeader.externalAssetId
vulnerableAsset.status	asset.assetHeader.status
vulnerableAsset.id	asset.assetHeader.vendorAssetId
vulnerableAsset.name	asset.assetDetail.name
vulnerableAsset.name	asset.assetDetail.hostIdentity.hostname
id	findingGroup.findings[].externalFindingId
portalUrl	findingGroup.findings[].findingURL
name	findingGroup.findings[].findingType.vulnerability.cveId
CVEDescription	findingGroup.findings[].description
status	findingGroup.findings[].findingStatus
severity	findingGroup.findings[].severity
firstDetectedAt	findingGroup.findings[].firstFoundOn
lastDetectedAt	findingGroup.findings[].lastFoundOn
resolvedAt	findingGroup.findings[].lastFixedOn
remediation	findingGroup.findings[].remediation.remediationStrategy
name	findingGroup.findings[].name
detailedName	findingGroup.findings[].product.name
version	findingGroup.findings[].product.version
detectionMethod	findingGroup.findings[].detectionMethod
hasExploit	findingGroup.findings[].findingType.vulnerability.isExploitAvailable
link	findingGroup.findings[].findingDetectionURL
cvssv3.attackVector	findingGroup.findings[].findingType.vulnerability.cvss.vector

VULNERABILITY - CONTAINER_IMAGE

 

asset_root (assetType)	asset.assetHeader.assetTypeName
vulnerableAsset.imageId	asset.assetHeader.externalAssetId
vulnerableAsset.status	asset.assetHeader.status
vulnerableAsset.id	asset.assetHeader.vendorAssetId
vulnerableAsset.name	asset.assetDetail.name
vulnerableAsset.name	asset.assetDetail.hostIdentity.hostname
id	findingGroup.findings[].externalFindingId
portalUrl	findingGroup.findings[].findingURL
detailedName	findingGroup.findings[].product.name
name	findingGroup.findings[].findingType.vulnerability.cveId
CVEDescription	findingGroup.findings[].description
status	findingGroup.findings[].findingStatus
severity	findingGroup.findings[].severity
firstDetectedAt	findingGroup.findings[].firstFoundOn
lastDetectedAt	findingGroup.findings[].lastFoundOn
resolvedAt	findingGroup.findings[].lastFixedOn
remediation	findingGroup.findings[].remediation.remediationStrategy
name	findingGroup.findings[].name
version	findingGroup.findings[].product.version
detectionMethod	findingGroup.findings[].detectionMethod
hasExploit	findingGroup.findings[].findingType.vulnerability.isExploitAvailable
link	findingGroup.findings[].findingDetectionURL
cvssv3.attackVector	findingGroup.findings[].findingType.vulnerability.cvss.vector

VULNERABILITY - SERVERLESS

asset_root (assetType)	asset.assetHeader.assetTypeName
vulnerableAsset.externalId	asset.assetHeader.externalAssetId
vulnerableAsset.status	asset.assetHeader.status
vulnerableAsset.id	asset.assetHeader.vendorAssetId
vulnerableAsset.name	asset.assetDetail.name
id	findingGroup.findings[].id
id	findingGroup.findings[].externalFindingId
portalUrl	findingGroup.findings[].findingURL
name	findingGroup.findings[].findingType.vulnerability.cveId
CVEDescription	findingGroup.findings[].description
status	findingGroup.findings[].findingStatus
severity	findingGroup.findings[].severity
firstDetectedAt	findingGroup.findings[].firstFoundOn
lastDetectedAt	findingGroup.findings[].lastFoundOn
resolvedAt	findingGroup.findings[].lastFixedOn
remediation	findingGroup.findings[].remediation.remediationStrategy
name	findingGroup.findings[].name
version	findingGroup.findings[].product.version
detectionMethod	findingGroup.findings[].detectionMethod
hasExploit	findingGroup.findings[].findingType.vulnerability.isExploitAvailable
link	findingGroup.findings[].findingDetectionURL
cvssv3.attackVector	findingGroup.findings[].findingType.vulnerability.cvss.vector