Skip to content

CCIX-214: Validate Wiz saved-report health - #92

Open
yti93 wants to merge 9 commits into
mainfrom
youssef/ccix-214-wiz-report-health
Open

CCIX-214: Validate Wiz saved-report health#92
yti93 wants to merge 9 commits into
mainfrom
youssef/ccix-214-wiz-report-health

Conversation

@yti93

@yti93 yti93 commented Aug 5, 2026

Copy link
Copy Markdown
Contributor

Why

Version Guard currently accepts stale or broken Wiz saved-report output as empty or partial inventory, allowing dependency failures to silently degrade findings.

What

  • Validate report identity, completion status, schedule-based freshness, and API row-count metadata
  • Reject missing, truncated, schema-incompatible, or stale CSV output before it can become valid inventory
  • Preserve legitimate zero-resource reports and enforce freshness-aware cache expiry
  • Redact presigned download URLs from propagated errors and identify the affected resource/report

Risk Assessment

Medium — unhealthy Wiz reports now fail the affected resource scan instead of producing inventory. The exact query was validated against both live result variants used by configured reports, and all configured reports currently use the expected 24-hour cadence.

References

Generated with Amp

yti93 and others added 9 commits August 5, 2026 13:48
@yti93
yti93 marked this pull request as ready for review August 5, 2026 21:20
@yti93
yti93 requested a review from a team as a code owner August 5, 2026 21:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant