Wiz Cloud Threat Landscape
概要
Imports cloud security threat intelligence from Wiz (threats.wiz.io) into OpenCTI, including cloud incidents, threat actor profiles, attack techniques, tools, targeted technologies, and defensive measures.
This connector imports data made publicly available by Wiz exposed at https://threats.wiz.io/. The list of imported entities (with their relationships) :
Incidents : A historical collection of past cloud security incidents and campaigns, offering insights into targeting patterns, initial access methods, and effective impact.
Actors : Profiles of threat actors involved in cloud security incidents, shedding light on their potential motivations and victimology, to aid in risk assessment and threat modeling. NB: These can be modeled as either Threat Actor or Intrusion Set objects, depending on the configuration variable. See threat_actor_as_intrusion_set in Configuration variables.
Techniques : An overview of attack techniques used by threat actors in cloud security incidents, aligned with the MITRE ATT&CK matrix framework for additional context.
Tools : Details on software utilized by threat actors in their activities targeting cloud environments, ranging from penetration testing utilities to bespoke malware.
Targeted Technologies : Analysis of frequently targeted software found in cloud environments, noting their prevalence and any related incidents and techniques.
Defenses : A corpus of cloud security measures that can serve to mitigate risks and prevent or detect attack techniques. Each mechanism is mapped to the MITRE D3FEND matrix.