Wiz Plugin for Risk Exchange - Netskope Technical Documentation

This document will provide the technical documentation that will be required to configure the Wiz v2.0.0 plugin with the Cloud Risk Exchange module of the Netskope Cloud Exchange platform. This plugin fetches Applications and Workloads from the Wiz platform. This plugin does not support performing any actions on the Applications and Workloads.

Prerequisites

To complete this integration, you need:

A Netskope tenant (or multiple, for example, production and development/test instances).
A Netskope Cloud Exchange tenant with the Tenant plugin and Risk Exchange plugin already configured.
Wiz platform credentials (Base URL, Token URL, Client ID, Client Secret) for API Authentication.
Connectivity to the following hosts: https://api.<region>.app.wiz.io.

Wiz Plugin Support

This plugin fetches Applications and Workloads from Wiz Platform.

Type of Data Pulled	Actions
Applications, Workloads	No Action

Mappings

Mapping will be used to view the pulled applications/workloads and their respective details. Mapped fields during plugin configuration will be visible on the Records page once the data is pulled. Below is the suggested mapping that should be used while configuring the plugin.

Pull Mappings for Applications

Plugin Field	Expected Datatype	Suggested Field Name	Suggested Field Action
Application ID	String	Wiz Application ID	Unique
Subscription External ID	String	Wiz Subscription External ID	Overwrite
Subscription ID	String	Wiz Subscription ID	Overwrite
Application Name	String	Wiz App Name	Overwrite
Cloud Platform	String	Wiz App Cloud Platform	Overwrite
Cloud Provider URL	String	Wiz App Cloud Provider URL	Overwrite
Creation Date	Date	Wiz App Creation Date	Overwrite
First Seen	Date	Wiz App First Seen	Overwrite
Last Seen	Date	Wiz App Last Seen	Overwrite

Pull Mappings for Workloads

Plugin Field	Expected Datatype	Suggested Field Name	Suggested Field Action
Workload ID	String	Wiz Workload ID	Unique
Name	String	Wiz Workload Name	Overwrite
Type	String	Wiz Workload Type	Overwrite
IP Addresses	List	Wiz Workload IP Addresses	Overwrite
Region	String	Wiz Workload Region	Overwrite
Cloud Platform	String	Wiz Workload Cloud Platform	Overwrite
Cloud Provider URL	String	Wiz Workload Cloud Provider URL	Overwrite
Status	String	Wiz Workload Status	Overwrite
Subscription Name	String	Wiz Subscription Name	Overwrite
Subscription External ID	String	Wiz Subscription External ID	Overwrite
Subscription ID	String	Wiz Subscription ID	Overwrite
OS	String	Wiz Workload OS	Overwrite
Tags	List	Wiz Workload Tags	Overwrite
Vulnerability Name	String	Wiz Vulnerability Name	Overwrite
CVSS Severity	String	Wiz CVSS Severity	Overwrite
Vulnerability Score	Number	Wiz Vulnerability Score	Overwrite
Exploitability Score	Number	Wiz Exploitability Score	Overwrite
Severity	String	Wiz Severity	Overwrite
Impact Score	Number	Wiz Impact Score	Overwrite
Vulnerability Status	String	Wiz Vulnerability Status	Overwrite
EPSS Severity	String	Wiz EPSS Severity	Overwrite
EPSS Percentile	Number	Wiz EPSS Percentile	Overwrite
EPSS Probability	Number	Wiz EPSS Probability	Overwrite
CNA Score	Number	Wiz CNA Score	Overwrite

Permissions

Required Scopes:

read:resources
read:vulnerabilities

API Details

List of APIs used

API Detail	Method	Endpoint	API Scope
Get auth token	POST	/oauth/token	None
Fetch Applications	POST	/graphql	–
Fetch Workloads	POST	/graphql

Get auth token

API endpoint: <Token URL>/oauth/token

Method: POST

Headers

Key	Value
accept	application/json
content-type	application/x-www-form-urlencoded
User-Agent	netskope-ce-6.0.1-cre-wiz-v2.0.0

Body:


{
      "grant_type": "client_credentials",
      "audience": "wiz-api",
      "client_id": client_id,
      "client_secret": client_secret,
}

Sample API Response


{
    "access_token": "eyJraWQiOiJEXC9ZNE1HUWE1UD….",
    "refresh_token": "eyJjdHkiOiJKV1QiLCJM8D3lHiLgKNu50A….",
    "expires_in": 86400,
    "token_type": "Bearer"
}

Fetch Applications

API endpoint: <Base URL>/graphql

Method: POST

Headers

Key	Value
Authorization	Bearer <Bearer Token>
Accept	application/json
User-Agent	netskope-ce-6.0.1-cre-wiz-v2.0.0

Body(GraphQL Query):


{
   "query": "query Table($first: Int, $after: String, \
   $filterBy: CloudResourceV2Filters) {    cloudResourcesV2(      \
   first: $first      after: $after      filterBy: $filterBy    ) \
   {      nodes {        id        name             type         \
   cloudAccount {            externalId            id        }    \
   graphEntity {            properties            firstSeen        \
   lastSeen        }      }      pageInfo {        hasNextPage      \
   endCursor      }    }  }",
   "variables":{"first":500,"filterBy":{"type":{"equals":["BUCKET"]}}}
}

Sample API Response


{
    "data": {
        "cloudResourcesV2": {
            "nodes": [
                {
                    "id": "3d42d73c-91f2-5a42-9392-5a7efd509ce0",
                    "name": "ai-agent-demo-ct-logs-984186218765-us-east-2",
                    "type": "BUCKET",
                    "cloudAccount": {
                        "externalId": "984186218765",
                        "id": "12327889-2de2-581a-9263-24f9d2172a05"
                    },
                    "graphEntity": {
                        "properties": {
                            "_vertexID": "3d42d73c-91f2-5a42-9392-5a7efd509ce0",
                            "accessibleFrom.internet": false,
                            "atRestEncryption": true,
                            "cloudPlatform": "AWS",
                            "cloudProviderURL": "https://console.aws.amazon.com/s3/buckets/ai-agent-demo-ct-logs-984186218765-us-east-2?region=us-east-2",
                            "creationDate": "2026-01-28T12:40:02Z",
                            "dataRiskScore": 4,
                            "deploymentCoverage_cloudEvents_deploymentStatus": "NotCovered",
                            "deploymentCoverage_cloudEvents_isLastSeenInTheLastDay": false,
                            "deploymentCoverage_cloudEvents_isLastSeenInTheLastWeek": false,
                            "encrypted": true,
                            "encryptedAtRest": true,
                            "encryptionAlgorithms": "AES256",
                            "encryptionInTransit": false,
                            "externalId": "ai-agent-demo-ct-logs-984186218765-us-east-2",
                            "fullResourceName": null,
                            "hasSensitiveData": true,
                            "isPublic": false,
                            "loggingEnabled": false,
                            "maxExposureLevel": 0,
                            "name": "ai-agent-demo-ct-logs-984186218765-us-east-2",
                            "nativeType": "bucket",
                            "numAddressesOpenForHTTP": 0,
                            "numAddressesOpenForHTTPS": 0,
                            "numAddressesOpenForNonStandardPorts": 0,
                            "numAddressesOpenForRDP": 0,
                            "numAddressesOpenForSSH": 0,
                            "numAddressesOpenForWINRM": 0,
                            "openToAllInternet": false,
                            "providerUniqueId": "arn:aws:s3:::ai-agent-demo-ct-logs-984186218765-us-east-2",
                            "publicExposure": "PublicExposureInvalid",
                            "region": "us-east-2",
                            "regionLocation": "US",
                            "regionType": "BucketRegionTypeMultiRegion",
                            "resourceGroupExternalId": null,
                            "retentionPeriod": 0,
                            "sizeBytes": 280836,
                            "sizeGiB": 0,
                            "status": "Active",
                            "subscriptionExternalId": "984186218765",
                            "tags": {
                                "Name": "AI Agent Demo CloudTrail Bucket",
                                "Purpose": "Demo"
                            },
                            "updatedAt": "2026-01-29T20:56:09Z",
                            "versioningEnabled": false,
                            "webHostingEnabled": false,
                            "zone": null
                        },
                        "firstSeen": "2026-01-28T16:49:05.791776Z",
                        "lastSeen": "2026-01-29T20:56:07Z"
                    }
                }
            ],
            "pageInfo": {
                "hasNextPage": true,
                "endCursor": "eyJmaWVsZHMiOlt7IkZp….."
            }
        }
    }
}

Fetch Workloads

API endpoint: <Base URL>/graphql

Method: POST

Headers

Key	Value
Authorization	Bearer <Bearer Token>
Accept	application/json
User-Agent	netskope-ce-6.0.1-cre-wiz-v2.0.0

Body(GraphQL Query):


{
   "query": "query VulnerabilityFindingsPage($filterBy: VulnerabilityFindingFilters, \
   $first: Int, $after: String) \
   {    vulnerabilityFindings(        filterBy: $filterBy      \
   first: $first        after: $after    ) \
   {        nodes {            id            name           score            \
   exploitabilityScore            severity            impactScore            \
   status            cnaScore                \
   epssSeverity            epssPercentile            epssProbability         \
   CVSSSeverity            vulnerableAsset \
   {                ... on VulnerableAssetBase {                    \
   id                    type                    name                    \
   region                    cloudProviderURL                    \
   cloudPlatform                    status                    \
   subscriptionName           subscriptionExternalId           \
   subscriptionId                  tags                }                \
   ... on VulnerableAssetVirtualMachine {                    \
   operatingSystem                    \
   ipAddresses                }            }        }        \
   pageInfo {            hasNextPage            endCursor        }    }}",
   "variables":{"first":500,"filterBy":{"updatedAt":{"after":"2026-01-21T09:21:43Z"}}}
}

Sample API Response


{
    "data": {
        "vulnerabilityFindings": {
            "nodes": [
                {
                    "id": "cbd8a235-da44-50d2-b794-8f95148627df",
                    "name": "CVE-2022-34903",
                    "score": 6.5,
                    "exploitabilityScore": 2.2,
                    "severity": "MEDIUM",
                    "impactScore": 4.2,
                    "status": "OPEN",
                    "epssSeverity": "HIGH",
                    "epssPercentile": 84.7,
                    "epssProbability": 2.4,
                    "cnaScore": 0,
                    "firstDetectedAt": "2022-12-07T02:29:45.544923Z",
                    "lastDetectedAt": "2026-01-28T18:50:51Z",
                    "description": "The package `gnupg2` version `2.0.22-5.amzn2.0.4` was detected in `YUM package manager` on a container image running `Amazon 2 (Karoo)` is vulnerable to `CVE-2022-34903`, which exists in versions `< 2.0.22-5.amzn2.0.5`.\n\nThe vulnerability was found in the [Official Amazon Linux Security Advisories](https://alas.aws.amazon.com/AL2/ALAS-2022-1834.html) with vendor severity: `Medium` ([NVD](https://nvd.nist.gov/vuln/detail/CVE-2022-34903) severity: `Medium`).\n\nThis vulnerability has a known exploit available. Source: [VulnCheck](http://www.openwall.com/lists/oss-security/2022/07/02/1).\n\nThe vulnerability can be remediated by updating the package to version `2.0.22-5.amzn2.0.5` or higher, by adding the following command to the Dockerfile: `RUN yum update gnupg2`.",
                    "CVEDescription": "GnuPG through 2.3.6, in unusual situations where an attacker possesses any secret-key information from a victim's keyring and other constraints (e.g., use of GPGME) are met, allows signature forgery via injection into the status line.",
                    "CVSSSeverity": "MEDIUM",
                    "vulnerableAsset": {
                        "id": "8b7026d8-6ab4-5519-9e09-2dee699bb572",
                        "type": "CONTAINER_IMAGE",
                        "name": "602401143452.dkr.ecr.us-east-1.amazonaws.com/amazon-k8s-cni@3b6db8b6",
                        "region": "us-east-1",
                        "cloudProviderURL": null,
                        "cloudPlatform": "AWS",
                        "status": "Active",
                        "subscriptionName": null,
                        "subscriptionExternalId": "602401143452",
                        "subscriptionId": "e644fdd8-9970-56a4-b285-44072d60a153",
                        "tags": {}
                    }
                }
            ],
            "pageInfo": {
                "hasNextPage": true,
                "endCursor": "eyJmaWVsZHMiOlt7IkZpZWx…."
            }
        }
    }
}

Performance Matrix

These performance readings were conducted on a Large Cloud Exchange Stack with these VM specifications by pulling 500k Applications/Workloads record each from the Wiz plugin.

Description	Specification
Stack details	Size: LargeRAM: 32 GBCPU: 16 Cores
Time taken to store the pulled Application records.	~ 25 minutes
Time taken to store the pulled Workload records.	~ 25 minutes

User Agent

netskope-ce-6.0.1-cre-wiz-v2.0.0

Workflow

Get your Client ID and Client Secret.
Configure the Wiz plugin.
Configure a Business Rule.
Configure Actions.
Validate the plugin.

Watch a Video

Click play to watch a video.

Get your Client ID and Client Secret

Contact Wiz Support team to obtain the Client ID and Client Secret.

Configure the Wiz Plugin

In Cloud Exchange, go to Settings > Plugin Store. Search for and select the Wiz v2.0.0 (CRE) plugin box.
Add a configuration name and change the sync interval if needed.
Click Next and enter the Configuration Parameters:
- API Endpoint URL: API Endpoint URL for Wiz platform based on Tenant type.
  Example: https://api.<TENANT_DATA_CENTER>.<ENVIRONMENT>.
- Token URL: Token URL for Wiz platform based on Tenant type to generate the auth token.
  Example: https://auth.app.wiz.io.
- Client ID: Client ID of Wiz platform.
- Client Secret: Client Secret of Wiz platform.
- Wiz Tables: Select the Wiz tables to fetch data from. By default, it will only have Applications selected. To map fields under Workloads Entity, users can select Workloads.
- Initial Range(in days): Number of days to pull the Workloads data for the initial run. Value must be from 0 to 2^62. Note this initial range is not applicable for Applications Entity.
Click Next and select the Applications Entity from the Entity dropdown. Provide the field mapping per your requirements.

Note If you are not able to see the Workloads Tab on Entity Sources page then click on Previous button and navigate to Configuration Parameters page, verify Wiz Tables field has the Workloads selected and then Navigate back to Entity Sources page.
To create a new field, click + Add Field.
Provide the Field Label, Data Type, and Aggregate Strategy per your requirements, and then click Save.
Similarly, map the fields for the Workload entity, if you want to pull the Workloads.
Note
- Application ID field will be required to pull the Applications.
- Workload ID field will be required to pull the Workloads.
- Refer to the Mappings section before configuring the plugin.
- Scroll up and Click on Save to configure the plugin.

Add a Risk Exchange Business Rule for Wiz

In Risk Exchange, go to Business Rules and click Create New Rule.
Enter the Rule Name. Select the Entity for the fields configured for the Wiz plugin, and configure the query based on your requirements. The below example filters all the xyz fetched from the Wiz plugin.
Click Save.

Add Risk Exchange Actions for Wiz

CRE Wiz supports the following action type:

No Action

No action will be performed for this action. Users can generate UBA alerts in Ticket Orchestrator by using this action and enabling the Generate Alerts toggle.

Note You can perform the actions on the applications/workloads pulled from Wiz on the Netskope Tenant, for performing the related actions on Netskope refer to the Netskope Risk Exchange plugin guide.

Steps to configure the Action

In Risk Exchange, go to Actions and click Add Action Configuration.
Select the required Business Rule, Configuration, and Action from their respective dropdowns.
Enable the Require Approval toggle if Approval is needed before performing action on the pulled records.
Click Save.

Validate the Wiz Plugin

Validate in Cloud Exchange

To validate the pulling:

In Risk Exchange, go to Records. Select the Entity that was selected while configuring the field mappings to view the pulled records.
Go to Logging and search for the logs related this plugin.
When a user matches one of the configured business rules, the configured action will be performed on the user. This can be seen in Risk Exchange at Action Logs.

Troubleshooting the Wiz Plugin

Unable to configure the Wiz plugin.

If you are unable to configure the CRE Wiz plugin, it could be due to one of these reasons:

Provided Incorrect Client ID and/or Client Secret.
Provided Credentials don’t have sufficient permissions.
Provided Token URL or Base URL that is invalid or incorrect.

What to do:

To get the Client ID and Client Secret follow the Wiz documentation.
To provide proper permissions to the configuration parameter, refer to the Wiz Documentation.
Ensure your credentials are valid for provided Base URL and Token URL.

Unable to pull applications/workloads

If you are unable to pull applications/workloads from the CRE Wiz plugin, it could be due to one of these reasons:

No applications/workloads present on the Wiz platform.
An error is received while pulling an application from the platform.
Mapping is not added while configuring the plugin in the entity source page.

What to do:

Check on the Wiz platform if applications exist or not.
Receiving 500 error: The server might be down, wait for a while and check later.
Receiving 403 error: The plugin configuration parameter does not have sufficient permissions or the credentials no longer exist. Verify the permission for the Client ID and Client Secret.
Receiving 401 error: The provided credentials while configuring the plugin no longer exist. Verify credentials and edit the plugin configuration with valid credentials if required.
If there is no error in the logs, it might be the case that the applications are not available on the Platform to pull. Check the applications available on Wiz and confirm the same.
For Applications, make sure that the mapping is added under Applications Entity and the mandatory “Application ID” field is mapped while configuring the plugin and for Workloads, make sure that the mapping is added under Workloads Entity and the mandatory “Workload ID” field is mapped while configuring the plugin .

Unable to View application/workload details on the Records page

If you are unable to view application/workload details on the record table, it could be due to one of the below-mentioned reasons.

Mapping for all the Wiz fields is not provided while configuring the CRE Wiz plugin.
Pulled applications/workloads are displayed in a row with comma separated values.

What to do:

Make sure to provide the needed mapping while configuring the plugin.
Make sure that the fields created in an entity are according to the Mapping.

Unable to find Workload Entity Source while configuring the plugin

If you are unable to find Workload Entity Source while configuring the plugin, it may be due to an incorrect value in Wiz Tables field in the Configuration Parameters.

What to do:

Go to the Configuration Parameters.
Verify if Workloads is added under Wiz Tables field.
Click Next, and then click Save.

Getting error while enabling the plugin after plugin upgrade

If user have upgraded to Wiz v2.0.0 from older plugin version and used Skip while upgrading the plugin then they might observe below error:

01/29/2026 10:21:11 AM - error CRE Wiz [CRE Wiz]: Validation error occurred. 'Wiz Tables' is a required configuration parameter.

What to do:

In Risk Exchange go to Plugins.
Edit the Wiz plugin configuration that you want to enable.
Click Next and go to the Configuration Parameters page.
Click Save to store the values of Wiz Tables and Initial Range (in days) fields.
Now enable the plugin.

Type of Data Pulled

Actions

Applications, Workloads

No Action

Plugin Field

Expected Datatype

Suggested Field Name

Suggested Field Action

Application ID

String

Wiz Application ID

Unique

Subscription External ID

String

Wiz Subscription External ID

Overwrite

Subscription ID

String

Wiz Subscription ID

Overwrite

Application Name

String

Wiz App Name

Overwrite

Cloud Platform

String

Wiz App Cloud Platform

Overwrite

Cloud Provider URL

String

Wiz App Cloud Provider URL

Overwrite

Creation Date

Date

Wiz App Creation Date

Overwrite

First Seen

Date

Wiz App First Seen

Overwrite

Last Seen

Date

Wiz App Last Seen

Overwrite

Plugin Field

Expected Datatype

Suggested Field Name

Suggested Field Action

Workload ID

String

Wiz Workload ID

Unique

Name

String

Wiz Workload Name

Overwrite

Type

String

Wiz Workload Type

Overwrite

IP Addresses

List

Wiz Workload IP Addresses

Overwrite

Region

String

Wiz Workload Region

Overwrite

Cloud Platform

String

Wiz Workload Cloud Platform

Overwrite

Cloud Provider URL

String

Wiz Workload Cloud Provider URL

Overwrite

Status

String

Wiz Workload Status

Overwrite

Subscription Name

String

Wiz Subscription Name

Overwrite

Subscription External ID

String

Wiz Subscription External ID

Overwrite

Subscription ID

String

Wiz Subscription ID

Overwrite

String

Wiz Workload OS

Overwrite

Tags

List

Wiz Workload Tags

Overwrite

Vulnerability Name

String

Wiz Vulnerability Name

Overwrite

CVSS Severity

String

Wiz CVSS Severity

Overwrite

Vulnerability Score

Number

Wiz Vulnerability Score

Overwrite

Exploitability Score

Number

Wiz Exploitability Score

Overwrite

Severity

String

Wiz Severity

Overwrite

Impact Score

Number

Wiz Impact Score

Overwrite

Vulnerability Status

String

Wiz Vulnerability Status

Overwrite

EPSS Severity

String

Wiz EPSS Severity

Overwrite

EPSS Percentile

Number

Wiz EPSS Percentile

Overwrite

EPSS Probability

Number

Wiz EPSS Probability

Overwrite

CNA Score

Number

Wiz CNA Score

Overwrite

API Detail

Method

Endpoint

API Scope

Get auth token

POST

/oauth/token

None

Fetch Applications

POST

/graphql

–

Fetch Workloads

POST

/graphql

Key

Value

application/json

content-type

application/x-www-form-urlencoded

User-Agent

netskope-ce-6.0.1-cre-wiz-v2.0.0

Key

Value

Authorization

Bearer <Bearer Token>

application/json

User-Agent

netskope-ce-6.0.1-cre-wiz-v2.0.0

{ "query": "query Table($first: Int, $after: String, \ $filterBy: CloudResourceV2Filters) { cloudResourcesV2( \ first: $first after: $after filterBy: $filterBy ) \ { nodes { id name type \ cloudAccount { externalId id } \ graphEntity { properties firstSeen \ lastSeen } } pageInfo { hasNextPage \ endCursor } } }", "variables":{"first":500,"filterBy":{"type":{"equals":["BUCKET"]}}} }

{ "data": { "cloudResourcesV2": { "nodes": [ { "id": "3d42d73c-91f2-5a42-9392-5a7efd509ce0", "name": "ai-agent-demo-ct-logs-984186218765-us-east-2", "type": "BUCKET", "cloudAccount": { "externalId": "984186218765", "id": "12327889-2de2-581a-9263-24f9d2172a05" }, "graphEntity": { "properties": { "_vertexID": "3d42d73c-91f2-5a42-9392-5a7efd509ce0", "accessibleFrom.internet": false, "atRestEncryption": true, "cloudPlatform": "AWS", "cloudProviderURL": "https://console.aws.amazon.com/s3/buckets/ai-agent-demo-ct-logs-984186218765-us-east-2?region=us-east-2", "creationDate": "2026-01-28T12:40:02Z", "dataRiskScore": 4, "deploymentCoverage_cloudEvents_deploymentStatus": "NotCovered", "deploymentCoverage_cloudEvents_isLastSeenInTheLastDay": false, "deploymentCoverage_cloudEvents_isLastSeenInTheLastWeek": false, "encrypted": true, "encryptedAtRest": true, "encryptionAlgorithms": "AES256", "encryptionInTransit": false, "externalId": "ai-agent-demo-ct-logs-984186218765-us-east-2", "fullResourceName": null, "hasSensitiveData": true, "isPublic": false, "loggingEnabled": false, "maxExposureLevel": 0, "name": "ai-agent-demo-ct-logs-984186218765-us-east-2", "nativeType": "bucket", "numAddressesOpenForHTTP": 0, "numAddressesOpenForHTTPS": 0, "numAddressesOpenForNonStandardPorts": 0, "numAddressesOpenForRDP": 0, "numAddressesOpenForSSH": 0, "numAddressesOpenForWINRM": 0, "openToAllInternet": false, "providerUniqueId": "arn:aws:s3:::ai-agent-demo-ct-logs-984186218765-us-east-2", "publicExposure": "PublicExposureInvalid", "region": "us-east-2", "regionLocation": "US", "regionType": "BucketRegionTypeMultiRegion", "resourceGroupExternalId": null, "retentionPeriod": 0, "sizeBytes": 280836, "sizeGiB": 0, "status": "Active", "subscriptionExternalId": "984186218765", "tags": { "Name": "AI Agent Demo CloudTrail Bucket", "Purpose": "Demo" }, "updatedAt": "2026-01-29T20:56:09Z", "versioningEnabled": false, "webHostingEnabled": false, "zone": null }, "firstSeen": "2026-01-28T16:49:05.791776Z", "lastSeen": "2026-01-29T20:56:07Z" } } ], "pageInfo": { "hasNextPage": true, "endCursor": "eyJmaWVsZHMiOlt7IkZp….." } } } }

Key

Value

Authorization

Bearer <Bearer Token>

application/json

User-Agent

netskope-ce-6.0.1-cre-wiz-v2.0.0

{ "query": "query VulnerabilityFindingsPage($filterBy: VulnerabilityFindingFilters, \ $first: Int, $after: String) \ { vulnerabilityFindings( filterBy: $filterBy \ first: $first after: $after ) \ { nodes { id name score \ exploitabilityScore severity impactScore \ status cnaScore \ epssSeverity epssPercentile epssProbability \ CVSSSeverity vulnerableAsset \ { ... on VulnerableAssetBase { \ id type name \ region cloudProviderURL \ cloudPlatform status \ subscriptionName subscriptionExternalId \ subscriptionId tags } \ ... on VulnerableAssetVirtualMachine { \ operatingSystem \ ipAddresses } } } \ pageInfo { hasNextPage endCursor } }}", "variables":{"first":500,"filterBy":{"updatedAt":{"after":"2026-01-21T09:21:43Z"}}} }

{ "data": { "vulnerabilityFindings": { "nodes": [ { "id": "cbd8a235-da44-50d2-b794-8f95148627df", "name": "CVE-2022-34903", "score": 6.5, "exploitabilityScore": 2.2, "severity": "MEDIUM", "impactScore": 4.2, "status": "OPEN", "epssSeverity": "HIGH", "epssPercentile": 84.7, "epssProbability": 2.4, "cnaScore": 0, "firstDetectedAt": "2022-12-07T02:29:45.544923Z", "lastDetectedAt": "2026-01-28T18:50:51Z", "description": "The package `gnupg2` version `2.0.22-5.amzn2.0.4` was detected in `YUM package manager` on a container image running `Amazon 2 (Karoo)` is vulnerable to `CVE-2022-34903`, which exists in versions `< 2.0.22-5.amzn2.0.5`.\n\nThe vulnerability was found in the [Official Amazon Linux Security Advisories](https://alas.aws.amazon.com/AL2/ALAS-2022-1834.html) with vendor severity: `Medium` ([NVD](https://nvd.nist.gov/vuln/detail/CVE-2022-34903) severity: `Medium`).\n\nThis vulnerability has a known exploit available. Source: [VulnCheck](http://www.openwall.com/lists/oss-security/2022/07/02/1).\n\nThe vulnerability can be remediated by updating the package to version `2.0.22-5.amzn2.0.5` or higher, by adding the following command to the Dockerfile: `RUN yum update gnupg2`.", "CVEDescription": "GnuPG through 2.3.6, in unusual situations where an attacker possesses any secret-key information from a victim's keyring and other constraints (e.g., use of GPGME) are met, allows signature forgery via injection into the status line.", "CVSSSeverity": "MEDIUM", "vulnerableAsset": { "id": "8b7026d8-6ab4-5519-9e09-2dee699bb572", "type": "CONTAINER_IMAGE", "name": "602401143452.dkr.ecr.us-east-1.amazonaws.com/amazon-k8s-cni@3b6db8b6", "region": "us-east-1", "cloudProviderURL": null, "cloudPlatform": "AWS", "status": "Active", "subscriptionName": null, "subscriptionExternalId": "602401143452", "subscriptionId": "e644fdd8-9970-56a4-b285-44072d60a153", "tags": {} } } ], "pageInfo": { "hasNextPage": true, "endCursor": "eyJmaWVsZHMiOlt7IkZpZWx…." } } } }

Description

Specification

Stack details

Size: LargeRAM: 32 GBCPU: 16 Cores

Time taken to store the pulled Application records.

~ 25 minutes

Time taken to store the pulled Workload records.

~ 25 minutes