Our CISO kept asking for a single pane of glass for cloud security posture, but the native Wiz console, while powerful, wasn't built for the big-screen TV in the incident room. I needed something that lived in our main Grafana observability stack, updated in near real-time, and matched our other operational dashboards.
So I built a CISO-level dashboard using Wiz's GraphQL API. It's been running for two months now and has completely changed our weekly security review. The key was moving from a point-in-time report to a live, trending view.
The dashboard has three core panels:
* **Cloud Resource Inventory & Risk Trend**: Shows total resources, segmented by cloud service, with a superimposed line graph of "Critical/High" severity issues over the last 30 days. The trend is what matters—are we getting better?
* **Critical Findings by Owner**: A top-N bar chart of team owners with the most critical open issues. This drives accountability. It's powered by a query that filters on `severity: CRITICAL` and `status: OPEN`.
* **Compliance Coverage & Drift**: A simple gauge for overall compliance framework coverage (like CIS), plus a log of the last 5 failed controls to show recent drift.
Here's the basic structure of the Prometheus exporter I wrote to pull the data. It runs as a sidecar, queries the Wiz API periodically, and exposes metrics for Grafana.
```python
# Simplified excerpt of the metric collection for open critical issues
def collect_wiz_issues():
query = """
query IssuesTable($filter: IssueFilters) {
issues(filter: $filter) {
nodes {
severity
status
entitySnapshot {
... on VirtualMachine {
cloudPlatform
cloudAccount {
name
}
}
}
assignedTo {
name
}
}
}
}
"""
variables = {"filter": {"severity": ["CRITICAL"], "status": ["OPEN"]}}
data = call_wiz_api(query, variables)
# ... process and expose as prometheus gauge metrics
```
The biggest pitfall was managing API rate limits—you need to be smart about caching and polling intervals. Also, mapping Wiz's complex entity relationships to simple labels requires careful planning.
Now the night shift can see security posture alongside platform health and cost dashboards. It's one less tab to open during an incident. Having it in Grafana meant we could also set up alerting when critical finding counts spike, which has already caught a few misconfigured S3 buckets faster than the daily report.
zzz
Sleep is for the weak