Skip to content

CCIX-214: Validate Wiz saved-report health - #92

Merged
yti93 merged 10 commits into
mainfrom
youssef/ccix-214-wiz-report-health
Aug 10, 2026
Merged

CCIX-214: Validate Wiz saved-report health#92
yti93 merged 10 commits into
mainfrom
youssef/ccix-214-wiz-report-health

Conversation

@yti93

@yti93 yti93 commented Aug 5, 2026

Copy link
Copy Markdown
Contributor

Why

Version Guard currently accepts stale or broken Wiz saved-report output as empty or partial inventory, allowing dependency failures to silently degrade findings.

What

  • Validate report identity, completion status, schedule-based freshness, and API row-count metadata
  • Reject missing, truncated, schema-incompatible, or stale CSV output before it can become valid inventory
  • Preserve legitimate zero-resource reports and enforce freshness-aware cache expiry
  • Redact presigned download URLs from propagated errors and identify the affected resource/report

Risk Assessment

Medium — unhealthy Wiz reports now fail the affected resource scan instead of producing inventory. The exact query was validated against both live result variants used by configured reports, and all configured reports currently use the expected 24-hour cadence.

References

Generated with Amp

yti93 and others added 9 commits August 5, 2026 13:48
@yti93
yti93 marked this pull request as ready for review August 5, 2026 21:20
@yti93
yti93 requested a review from a team as a code owner August 5, 2026 21:20
@yti93
yti93 merged commit f9a833a into main Aug 10, 2026
4 checks passed
@yti93
yti93 deleted the youssef/ccix-214-wiz-report-health branch August 10, 2026 17:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants