[ASIM] Wiz.io Alert and Authentication parser

[Manuel Hauch (manuelhauch)]

[ASIM] Wiz.io Alert and Authentication parsers. Authentication covers Wiz Cloud via the audit logs. Alert parsers are split by Wiz product for Wiz Cloud and Wiz Defend seperately.

Required items, please complete

Change(s):

• Added Authentication parser for Wiz Cloud
• Added Alert Event parser for Wiz Cloud
• Added Alert Event parser for Wiz Defend

Reason for Change(s):

• New supported data source

Version Updated:

• Yes, for the parsers

Testing Completed:

• Yes

Checked that the validations are passing and have addressed any issues that are present:

• Yes

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Adds ASIM parsers for Wiz.io to normalize Wiz Cloud authentication events and Wiz Cloud/Wiz Defend alert events, plus deployment assets and validation/test artifacts.

Changes:

• Added new ASIM Authentication parsers for Wiz Cloud (ASim + filtering “vim” parser), with ARM templates and changelogs.
• Added new ASIM AlertEvent parsers for Wiz Cloud (Issues) and Wiz Defend (Detections), with ARM templates, changelogs, sample data, and schema/data tests.
• Updated unifying parsers (ASimAuthentication/imAuthentication and ASimAlertEvent/imAlertEvent) to include the new Wiz parsers and bumped versions.

Reviewed changes

Copilot reviewed 50 out of 50 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
Sample Data/Wiz_Defend_AlertEvent_IngestedLogs.csv	Adds sample Wiz Defend detections data to validate AlertEvent parsing.
Sample Data/Wiz_Cloud_Authentication_IngestedLogs.csv	Adds sample Wiz audit log auth data for Authentication parser validation.
Sample Data/Wiz_Cloud_AlertEvent_IngestedLogs.csv	Adds sample Wiz Issues data for AlertEvent parser validation.
Parsers/ASimAuthentication/Tests/Wiz_Cloud_Authentication_SchemaTest.csv	Captures schema validation results for Wiz Cloud authentication normalization.
Parsers/ASimAuthentication/Tests/Wiz_Cloud_Authentication_DataTest.csv	Captures data-quality validation results for Wiz Cloud authentication normalization.
Parsers/ASimAuthentication/Parsers/vimAuthenticationWizCloud.yaml	New filtering Authentication parser for Wiz Cloud.
Parsers/ASimAuthentication/Parsers/imAuthentication.yaml	Registers Wiz Cloud Authentication filtering parser and bumps version.
Parsers/ASimAuthentication/Parsers/ASimAuthenticationWizCloud.yaml	New Authentication normalization parser for Wiz Cloud.
Parsers/ASimAuthentication/Parsers/ASimAuthentication.yaml	Registers Wiz Cloud Authentication parser and bumps version.
Parsers/ASimAuthentication/CHANGELOG/vimAuthenticationWizCloud.md	Changelog for new Wiz Cloud filtering Authentication parser.
Parsers/ASimAuthentication/CHANGELOG/imAuthentication.md	Notes Wiz Cloud addition in unifying filtering parser changelog.
Parsers/ASimAuthentication/CHANGELOG/ASimAuthenticationWizCloud.md	Changelog for new Wiz Cloud Authentication normalization parser.
Parsers/ASimAuthentication/CHANGELOG/ASimAuthentication.md	Notes Wiz Cloud addition in unifying Authentication parser changelog.
Parsers/ASimAuthentication/ARM/vimAuthenticationWizCloud/vimAuthenticationWizCloud.json	ARM template to deploy Wiz Cloud filtering Authentication parser.
Parsers/ASimAuthentication/ARM/vimAuthenticationWizCloud/README.md	Deployment doc for Wiz Cloud filtering Authentication parser.
Parsers/ASimAuthentication/ARM/imAuthentication/imAuthentication.json	Updates ARM template query to include Wiz Cloud filtering Authentication parser.
Parsers/ASimAuthentication/ARM/FullDeploymentAuthentication.json	Adds linked deployments for Wiz Cloud Authentication parsers.
Parsers/ASimAuthentication/ARM/ASimAuthenticationWizCloud/README.md	Deployment doc for Wiz Cloud Authentication normalization parser.
Parsers/ASimAuthentication/ARM/ASimAuthenticationWizCloud/ASimAuthenticationWizCloud.json	ARM template to deploy Wiz Cloud Authentication normalization parser.
Parsers/ASimAuthentication/ARM/ASimAuthentication/ASimAuthentication.json	Updates unifying Authentication ARM template to include Wiz Cloud parser.
Parsers/ASimAlertEvent/Tests/Wiz_Defend_AlertEvent_SchemaTest.csv	Captures schema validation results for Wiz Defend AlertEvent normalization.
Parsers/ASimAlertEvent/Tests/Wiz_Defend_AlertEvent_DataTest.csv	Captures data-quality validation results for Wiz Defend AlertEvent normalization.
Parsers/ASimAlertEvent/Tests/Wiz_Cloud_AlertEvent_SchemaTest.csv	Captures schema validation results for Wiz Cloud Issues AlertEvent normalization.
Parsers/ASimAlertEvent/Tests/Wiz_Cloud_AlertEvent_DataTest.csv	Captures data-quality validation results for Wiz Cloud Issues AlertEvent normalization.
Parsers/ASimAlertEvent/Parsers/vimAlertEventWizDefend.yaml	New filtering AlertEvent parser for Wiz Defend detections.
Parsers/ASimAlertEvent/Parsers/vimAlertEventWizCloud.yaml	New filtering AlertEvent parser for Wiz Cloud issues.
Parsers/ASimAlertEvent/Parsers/imAlertEvent.yaml	Registers Wiz Cloud/Wiz Defend filtering AlertEvent parsers and bumps version.
Parsers/ASimAlertEvent/Parsers/ASimAlertEventWizDefend.yaml	New AlertEvent normalization parser for Wiz Defend detections.
Parsers/ASimAlertEvent/Parsers/ASimAlertEventWizCloud.yaml	New AlertEvent normalization parser for Wiz Cloud issues.
Parsers/ASimAlertEvent/Parsers/ASimAlertEvent.yaml	Registers Wiz Cloud/Wiz Defend AlertEvent parsers and bumps version.
Parsers/ASimAlertEvent/CHANGELOG/vimAlertEventWizDefend.md	Changelog for new Wiz Defend filtering AlertEvent parser.
Parsers/ASimAlertEvent/CHANGELOG/vimAlertEventWizCloud.md	Changelog for new Wiz Cloud filtering AlertEvent parser.
Parsers/ASimAlertEvent/CHANGELOG/imAlertEvent.md	Notes Wiz additions in unifying filtering AlertEvent parser changelog.
Parsers/ASimAlertEvent/CHANGELOG/ASimAlertEventWizDefend.md	Changelog for new Wiz Defend AlertEvent normalization parser.
Parsers/ASimAlertEvent/CHANGELOG/ASimAlertEventWizCloud.md	Changelog for new Wiz Cloud AlertEvent normalization parser.
Parsers/ASimAlertEvent/CHANGELOG/ASimAlertEvent.md	Notes Wiz additions in unifying AlertEvent parser changelog.
Parsers/ASimAlertEvent/ARM/vimAlertEventWizDefend/vimAlertEventWizDefend.json	ARM template to deploy Wiz Defend filtering AlertEvent parser.
Parsers/ASimAlertEvent/ARM/vimAlertEventWizDefend/README.md	Deployment doc for Wiz Defend filtering AlertEvent parser.
Parsers/ASimAlertEvent/ARM/vimAlertEventWizCloud/vimAlertEventWizCloud.json	ARM template to deploy Wiz Cloud filtering AlertEvent parser.
Parsers/ASimAlertEvent/ARM/vimAlertEventWizCloud/README.md	Deployment doc for Wiz Cloud filtering AlertEvent parser.
Parsers/ASimAlertEvent/ARM/imAlertEvent/imAlertEvent.json	Updates unifying filtering AlertEvent ARM template to include Wiz parsers.
Parsers/ASimAlertEvent/ARM/FullDeploymentAlertEvent.json	Adds linked deployments for Wiz AlertEvent parsers.
Parsers/ASimAlertEvent/ARM/ASimAlertEventWizDefend/README.md	Deployment doc for Wiz Defend AlertEvent normalization parser.
Parsers/ASimAlertEvent/ARM/ASimAlertEventWizDefend/ASimAlertEventWizDefend.json	ARM template to deploy Wiz Defend AlertEvent normalization parser.
Parsers/ASimAlertEvent/ARM/ASimAlertEventWizCloud/README.md	Deployment doc for Wiz Cloud AlertEvent normalization parser.
Parsers/ASimAlertEvent/ARM/ASimAlertEventWizCloud/ASimAlertEventWizCloud.json	ARM template to deploy Wiz Cloud AlertEvent normalization parser.
Parsers/ASimAlertEvent/ARM/ASimAlertEvent/ASimAlertEvent.json	Updates unifying AlertEvent ARM template to include Wiz parsers.
.script/tests/KqlvalidationsTests/WizIssuesV3_CL.json	Adds schema stub for WizIssuesV3_CL to support KQL validation tests.
.script/tests/KqlvalidationsTests/WizDetectionsV3_CL.json	Adds schema stub for WizDetectionsV3_CL to support KQL validation tests.
.script/tests/KqlvalidationsTests/WizAuditlogsV3_CL.json	Adds schema stub for WizAuditlogsV3_CL to support KQL validation tests.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[v-atulyadav]

Hi Manuel Hauch (@manuelhauch),
Please review validation failures. Thanks

[Manuel Hauch (manuelhauch)]

Hi Manuel Hauch (Manuel Hauch (@manuelhauch)), Please review validation failures. Thanks

Thanks v-atulyadav, moved the sample files to the right sub folder.

[Manuel Hauch (manuelhauch)]

v-atulyadav this must be an error in the validation script:

"ASIM schema "Authentication" version "0.1.4" is incorrect. The correct version for ASIM schema "Authentication" is "1.0.0""

[Manuel Hauch (manuelhauch)]

Seems like this was introduced through the changes today. Bumping all ASIM schema versions to version 1.0.0.

d72811e

v-atulyadav assuming this is correct, can you update the doc pages. They don't specify this bump in schema versions yet. https://learn.microsoft.com/en-us/azure/sentinel/normalization-schema-authentication#schema-updates

[Manuel Hauch (manuelhauch)]

Seems like this was introduced through the changes today. Bumping all ASIM schema versions to version 1.0.0.

d72811e

v-atulyadav assuming this is correct, can you update the doc pages. They don't specify this bump in schema versions yet. https://learn.microsoft.com/en-us/azure/sentinel/normalization-schema-authentication#schema-updates

Updated the parsers to align with the new schema versions. This should go through testing now.

[Manuel Hauch (manuelhauch)]

v-atulyadav this now fails on API rate limits in the YAML File syntax validation.