Table: wiz_user - Query Wiz User using SQL
Wiz is a cloud security platform that discovers all assets in your cloud environment to detect critical risks and security holes. It provides a holistic view of each resource, including metadata, configurations, network paths, and potential vulnerabilities. Wiz User represents the user accounts in the Wiz platform, each having specific roles and permissions.
Table Usage Guide
The wiz_user
table provides insights into user accounts within the Wiz platform. As a security analyst, you can explore user-specific details through this table, including roles, permissions, and associated metadata. Utilize it to uncover information about user accounts, such as those with admin permissions, the roles assigned to each user, and the verification of user statuses.
Examples
Basic info
Gain insights into user details such as their role and status (active or suspended), as well as their last login and account creation dates. This can be useful for understanding user behavior and managing user access.
select name, email, identity_provider_type, role ->> 'name' as role, is_suspended, last_login_at, created_atfrom wiz_user;
select name, email, identity_provider_type, json_extract(role, '$.name') as role, is_suspended, last_login_at, created_atfrom wiz_user;
List suspended users
Discover the segments that consist of suspended users to assess potential security risks or to manage user access, ensuring a safer and more controlled environment.
select name, email, identity_provider_type, role ->> 'name' as role, last_login_at, created_atfrom wiz_userwhere is_suspended;
select name, email, identity_provider_type, json_extract(role, '$.name') as role, last_login_at, created_atfrom wiz_userwhere is_suspended;
List inactive users
Discover the segments that include users who have not logged in yet. This can be useful in identifying inactive users for potential outreach or account clean-up efforts.
select name, email, identity_provider_type, role ->> 'name' as role, is_suspended, created_atfrom wiz_userwhere last_login_at is null;
select name, email, identity_provider_type, json_extract(role, '$.name') as role, is_suspended, created_atfrom wiz_userwhere last_login_at is null;
List all administrators
Discover the segments that have global administrators and their corresponding details, without including project-scoped roles. This helps in identifying and managing users with overarching control and access within your system.
select name, email, identity_provider_type, role ->> 'name' as role, created_atfrom wiz_userwhere role ->> 'id' = 'GLOBAL_ADMIN' and not (role ->> 'isProjectScoped') :: boolean;
select name, email, identity_provider_type, json_extract(role, '$.name') as role, created_atfrom wiz_userwhere json_extract(role, '$.id') = 'GLOBAL_ADMIN' and not json_extract(role, '$.isProjectScoped');
List users scoped to a specific project
Explore which users are assigned to a specific project. This can help in understanding the distribution of team members across projects, facilitating efficient resource management and task allocation.
select u.name, u.email, u.identity_provider_type, u.role ->> 'name' as role, p.name as project, u.created_atfrom wiz_user as u, jsonb_array_elements(u.effective_assigned_projects) as ep join wiz_project as p on ep ->> 'id' = p.id;
select u.name, u.email, u.identity_provider_type, json_extract(u.role, '$.name') as role, p.name as project, u.created_atfrom wiz_user as u, json_each(u.effective_assigned_projects) as ep join wiz_project as p on json_extract(ep.value, '$.id') = p.id;
List all SAML users
Discover the segments that are using SAML as their identity provider. This can be particularly useful to understand user distribution across different identity providers and assess if any particular group needs attention.
select name, email, identity_provider_type, role ->> 'name' as role, is_suspended, last_login_at, created_atfrom wiz_userwhere identity_provider_type = 'SAML';
select name, email, identity_provider_type, json_extract(role, '$.name') as role, is_suspended, last_login_at, created_atfrom wiz_userwhere identity_provider_type = 'SAML';
Schema for wiz_user
Name | Type | Operators | Description |
---|---|---|---|
_ctx | jsonb | Steampipe context in JSON form, e.g. connection_name. | |
created_at | timestamp with time zone | The time when the user was created. | |
effective_assigned_projects | jsonb | A list of project ids this user was last logged in with. Null value means all projects are allowed. | |
text | The email address of the user. | ||
id | text | = | A unique identifier of the user. |
identity_provider_type | text | = | The auth provider type of the user. Possible values are: WIZ, SAML. |
ip_address | inet | The IP address of the user. | |
is_analytics_enabled | boolean | If true, the user analytics is enabled. | |
is_suspended | boolean | If true, the user is suspended. | |
last_login_at | timestamp with time zone | The time when the user was last login to the console. | |
name | text | The display name of the user. | |
role | jsonb | Specifies the role assigned to the user. | |
tenant_id | text | Specifies the tenant the user is a member of. |
Export
This table is available as a standalone Exporter CLI. Steampipe exporters are stand-alone binaries that allow you to extract data using Steampipe plugins without a database.
You can download the tarball for your platform from the Releases page, but it is simplest to install them with the steampipe_export_installer.sh
script:
/bin/sh -c "$(curl -fsSL https://steampipe.io/install/export.sh)" -- wiz
You can pass the configuration to the command with the --config
argument:
steampipe_export_wiz --config '<your_config>' wiz_user