Artifact scans with Wiz

Scan container image and repository artifacts with Wiz, using Orchestration or Ingestion mode, from a containerized step group

You can set up a Wiz step to run automated scans in a Harness pipeline. This step scans the container image you specify using the Wiz CLI. Harness Security Testing Orchestration (STO) then correlates, deduplicates, and ingests the scan results. Go to the Vulnerabilities tab of the pipeline execution to view your scan results.

Wiz CLI upgrade notice

The Wiz CLI is upgraded from version 0.x to 1.x. Harness STO supports this upgrade transparently, and no pipeline changes are required. CLI version 0.x continues to work with existing credentials, while CLI version 1.x requires new credentials. Credentials used with CLI 0.x are not supported in CLI 1.x.

---

What you will learn from this topic

• How to set up an Orchestration scan or an Ingestion scan for artifacts

• How to configure the Wiz step settings, including scan mode, target, and authentication

• How to view Wiz policy failures and use proxy settings

• How to use a sample pipeline for Orchestration mode or Ingestion mode

---

Before you begin

To scan an artifact with Wiz, you need the following:

• A CI Build or Security Tests stage in your pipeline.

• A Kubernetes or Docker build infrastructure, if you are running an Orchestration scan.

• Harness text secrets for your client-id and client-secret to authenticate with the Wiz CLI, and for your image registry access ID and access token, if your registry requires authentication.

---

Important notes for running Wiz scans in STO

The following notes apply when you run Wiz scans in STO:

• You can set up your STO scan images and pipelines to run scans as non-root and establish trust for your proxies using custom certificates. For more information, go to Configure your pipeline to use STO images from private registry.

• If you use Wiz for Gov or GovCloud on Linux or macOS, configure the WIZ_ENV environment variable in your Wiz stage settings.

  • For app.wiz.us (Wiz for Gov, FedRAMP), set WIZ_ENV=fedramp.

  • For gov.wiz.io (GovCloud), set WIZ_ENV=gov.

Configure WIZ_ENV in stage settings for Wiz for Gov and GovCloud

---

Set-up workflows

Choose the workflow that matches whether you want Harness to run the Wiz CLI scan (Orchestration) or ingest scan results produced outside the Wiz step (Ingestion).

Orchestration scans for artifacts

The setup process for Kubernetes and Docker build infrastructures has a few additional steps and requirements.

PrerequisitesA Kubernetes or Docker build infrastructure.Harness text secrets if your image registry requires an access ID and access token.Harness text secrets for your client-id and client-secret to authenticate with the Wiz CLI.Add a Docker-in-Docker background stepOrchestrated image scans on Kubernetes or Docker build infrastructures require a Docker-in-Docker (DinD) Background step.Add the Wiz scannerPerform the following steps to add the Wiz scanner:Add a CI Build or Security stage to your pipeline.Add a Wiz step to the stage.Set up the Wiz scanner using the required and optional settings below.Required settingsScan mode = Orchestration.Target type = Container image.Target and Variant Detection = Auto.Under Container image:Type.Domain: Required only if you are using a registry with a non-standard domain, such as a private registry.Name: For example, jsmith/myimage.Tag: For example, latest.Authentication: Required only if the registry requires authentication:Registry access ID as a Harness secret.Registry access token as a Harness secret.Authentication:Wiz access ID as a Harness secret. This is your client-id to authenticate with the Wiz CLI.Wiz access token as a Harness secret. This is your client-secret to authenticate with the Wiz CLI.Optional settingsFail on Severity: Stop the pipeline if the scan detects any issues at a specified severity or higher.Log Level: Useful for debugging.PrerequisitesHarness text secrets if your image registry requires an access ID and access token.Harness text secrets for your client-id and client-secret to authenticate with the Wiz CLI.Add the Wiz scannerPerform the following steps to add the Wiz scanner:Add a Build or Security stage to your pipeline.Add a Wiz step to the stage.Set up the Wiz scanner using the required and optional settings below.Required settingsScan mode = Orchestration.Target type = Container image.Target and Variant Detection = Auto.Under Container image:Type.Domain: Required only if you are using a registry with a non-standard domain, such as a private registry.Name: For example, jsmith/myimage.Tag: For example, latest.Authentication: Required only if the registry requires authentication:Registry access ID as a Harness secret.Registry access token as a Harness secret.Authentication:Wiz access ID as a Harness secret. This is your client-id to authenticate with the Wiz CLI.Wiz access token as a Harness secret. This is your client-secret to authenticate with the Wiz CLI.Optional settingsFail on Severity: Stop the pipeline if the scan detects any issues at a specified severity or higher.Log Level: Useful for debugging.

Ingestion scans for artifacts

JSON is the recommended ingestion format

Harness STO can ingest both JSON and SARIF data from Wiz. Harness recommends publishing to JSON because this format includes more detailed information.

Add a shared path for your scan results

Perform the following steps to add a shared path:

1. Add a Build or Security stage to your pipeline.

2. In the stage Overview, add a shared path such as /shared/scan_results.

Copy scan results to the shared path

There are two primary workflows to copy scan results to the shared path:

• Add a Run step that runs a Wiz scan from the command line and then copies the results to the shared path.

• Copy results from a Wiz scan that ran outside the pipeline.

For more information and examples, go to Ingestion scans.

Set up the Wiz scanner

Add a Wiz step to the stage and set it up as follows.

Required settings

1. Scan mode = Ingestion.

2. Target type = Container Image.

3. Target name: Usually the image name, such as jsmith/myimage.

4. Target variant: Usually the image tag, such as latest. You can also use a runtime input and specify the tag at runtime.

5. Ingestion file: For example, /shared/scan_results/wiz-scan.json.

Optional settings

• Fail on Severity: Stop the pipeline if the scan detects any issues at a specified severity or higher.

• Log Level: Useful for debugging.

---

Wiz step settings reference

The recommended workflow is to add a Wiz step to a Security Tests or CI Build stage, and then configure the settings below.

Scan

Scan Mode sets whether the step runs a new Wiz CLI scan (Orchestration) or ingests results produced outside the step (Ingestion). Go to Wiz step settings reference for the full description of each mode.

Target

Type, Target and Variant Detection, Variant, and Workspace identify the artifact being scanned. Go to Wiz step settings reference for the full description of each field.

Name

The identifier for the target, such as jsmith/myalphaservice. Descriptive target names make it easier to navigate your scan data in the STO UI.

It is good practice to specify a baseline for every target.

Container image

Type, Domain, Name, Tag/Digest, Access ID, and Access Token identify and authenticate to the registry that hosts the scanned image. Go to Wiz step settings reference for the full description of each field.

Ingestion File

The path to your scan results when running an Ingestion scan, for example /shared/scan_results/wiz.latest.json.

• The data file must be in a supported format for the scanner.

• The data file must be accessible to the scan step. It is good practice to save your results files to a shared path in your stage. In the visual editor, go to the stage where you are running the scan, and then go to Overview -> Shared Paths. You can also add the path to the YAML stage definition, for example:

- stage:
    spec:
      sharedPaths:
        - /shared/scan_results

Authentication

Access ID

This is your client-id to authenticate with the Wiz CLI.

Access Token

This is your client-secret to authenticate with the Wiz CLI.

Create a Harness text secret with your encrypted token, and reference the secret using the format <+secrets.getValue("my-access-token")>. For more information, go to Add and reference text secrets.

Log Level

Set the logging verbosity for the Wiz CLI. Go to Wiz step settings reference for the full description.

Additional CLI flags

Pass additional flags directly to the Wiz CLI.

Advanced feature

Passing CLI flags is an advanced feature. Some flags might not work in the context of STO. Test your flags and arguments thoroughly before you use them in your production environment.

Fail on Severity

Stop the pipeline if the scan detects any issues at a specified severity or higher.

Settings

You can add more settings to the scan step as needed.

Additional Configuration

The fields under Additional Configuration vary based on the type of infrastructure. Depending on the infrastructure type you select, some fields might not appear in your settings.

• Override Security Test Image: Container Registry and Image Tag.

• Privileged

• Image Pull Policy

• Run as User

• Set Container Resources

• Timeout

Advanced settings

In Advanced, you can use the following options:

• Conditional Execution

• Failure Strategy

• Looping Strategy

• Policy Enforcement

---

View Wiz policy failures

Wiz policy failure results appear in the scan results as an Info level issue, categorized as an External Policy issue type. Go to Wiz step settings reference for the full procedure to configure external policy failures and map them to a severity level.

---

Proxy settings

This step supports private network connectivity if you use Harness Cloud infrastructure. Go to Wiz step settings reference for the HTTPS_PROXY, HTTP_PROXY, and NO_PROXY variable definitions and configuration steps.

---

Sample Pipeline

The following examples show a sample pipeline for each scan mode.

Sample YAML: Orchestration mode

pipeline:
  name: cd-wiz-orchestration
  identifier: cdwizorchestration
  projectIdentifier: your_project_identifier
  orgIdentifier: your_org_identifier
  tags: {}
  stages:
    - stage:
        name: s1
        identifier: s1
        description: ""
        type: Deployment
        spec:
          deploymentType: Kubernetes
          service:
            serviceRef: your_service_identifier
          environment:
            environmentRef: your_environment_identifier
            deployToAll: false
            infrastructureDefinitions:
              - identifier: your_infrastructure_identifier
          execution:
            steps:
              - stepGroup:
                  name: sg
                  identifier: sg
                  steps:
                    - step:
                        type: Wiz
                        name: Wiz_1
                        identifier: Wiz_1
                        spec:
                          mode: orchestration
                          config: default
                          target:
                            type: container
                            detection: manual
                            name: test
                            variant: test
                          advanced:
                            log:
                              level: info
                          privileged: true
                          image:
                            type: docker_v2
                            tag: 14-alpine
                            name: library/node
                            domain: docker.io
                          auth:
                            access_token: your_access_token
                            access_id: your_access_id
                  stepGroupInfra:
                    type: KubernetesDirect
                    spec:
                      connectorRef: your_k8s_connector
            rollbackSteps: []
        tags: {}
        failureStrategies:
          - onFailure:
              errors:
                - AllErrors
              action:
                type: StageRollback

Sample YAML: Ingestion mode

pipeline:
  name: wiz-ingestion1
  identifier: wizingestion1
  projectIdentifier: your_project_identifier
  orgIdentifier: default
  tags: {}
  stages:
    - stage:
        name: s1
        identifier: s1
        description: ""
        type: Deployment
        spec:
          deploymentType: Kubernetes
          service:
            serviceRef: your_service_identifier
          environment:
            environmentRef: your_environment_identifier
            deployToAll: false
            infrastructureDefinitions:
              - identifier: your_infrastructure_identifier
          execution:
            steps:
              - stepGroup:
                  name: sg1
                  identifier: sg1
                  steps:
                    - step:
                        type: Run
                        name: Run_1
                        identifier: Run_1
                        spec:
                          connectorRef: a
                          image: alpine
                          shell: Sh
                          command: |-
                            cat <<EOF >> example.json
                            {  
                               "meta":{  
                                  "key":[  
                                     "issueName",  
                                     "fileName"  
                                  ],  
                                  "subproduct":"MyCustomScanner"  
                               },  
                               "issues":[  
                                  {  
                                     "subproduct":"MyCustomScanTool",  
                                     "issueName":"Cross Site Scripting",  
                                     "issueDescription":"Lorem ipsum...",  
                                     "fileName":"homepage-jobs.php",  
                                     "remediationSteps":"Fix me fast.",  
                                     "risk":"high",  
                                     "severity":8,  
                                     "status":"open",  
                                     "referenceIdentifiers":[  
                                        {  
                                           "type":"cwe",  
                                           "id":"79"  
                                        }  
                                     ]  
                                  }  
                               ]  
                            }
                            EOF
                            ls
                            cat example.json
                    - step:
                        type: Wiz
                        name: Wiz_1
                        identifier: Wiz_1
                        spec:
                          mode: ingestion
                          config: default
                          target:
                            type: repository
                            detection: manual
                            name: external-scanner-test
                            variant: main
                          advanced:
                            log:
                              level: info
                          privileged: true
                          ingestion:
                            file: example.json
                  stepGroupInfra:
                    type: KubernetesDirect
                    spec:
                      connectorRef: your_k8s_connector
            rollbackSteps: []
        tags: {}
        failureStrategies:
          - onFailure:
              errors:
                - AllErrors
              action:
                type: StageRollback

---

Next steps

• Go to Containerize step groups to run this step on your Kubernetes cluster.

• Go to Background step to configure the Docker-in-Docker step an Orchestration scan requires.

• Go to What's supported in STO, Security Testing Orchestration FAQs, and Optimize STO pipelines for more on setting up scanner integrations in STO.