Findings Reference

Overview

The Findings report is the output of the CSPM integration: one row per Wiz-flagged cloud role, enriched with what Britive knows about that role. This page documents what each column means, where the value comes from, and how to query the same data through the API.

Findings are always scoped to one integration. There is no cross-integration view — if you run several Wiz integrations, you read each one’s findings separately.

The Findings Table

Open it at System Admin → CSPM Integration → Manage on an integration → Findings.

Two fields are returned by the API but not shown as columns:

How Each Value Is Resolved

Britive correlates a finding by walking a chain from the role Wiz reported to the profiles that grant it. Each hop can fail independently, which is what produces the partially-populated rows you see in the report.

    flowchart TD
    A["Wiz finding<br/>resource type = role"] --> B{"Role's native id matches<br/>a cataloged Britive role?"}
    B -->|No| C["Unresolved<br/>Application, Profile, Britive Role all empty"]
    B -->|Yes| D["Britive Role populated"]
    D --> E["Application + App Type populated<br/>via the role's environment"]
    E --> F{"Subscription id matches<br/>a Britive environment?"}
    F -->|No| G["Environment empty"]
    F -->|Yes| H["Environment = Name (id)"]
    E --> I{"Any profile grants<br/>this role?"}
    I -->|No| J["Unresolved<br/>Profile empty, Source = External"]
    I -->|Yes| K["Resolved<br/>Profile populated"]
  

Britive Role, Application, and App Type

Britive matches Wiz’s resource.id — the cloud provider’s native role identifier — against the native id of the roles in its own permission catalog, requiring the resource type to be role on both sides.

Application and App Type come from the role’s own environment, not from any profile. That means they populate as soon as the role is cataloged in Britive at all, even if no profile grants it. This is deliberate: it’s what makes the “Britive knows this role but nothing governs it” case visible.

Profile and Status

Status is gated on the profile chain alone:

• Resolved — at least one Britive profile grants this role
• Unresolved — no profile grants it

A populated Application with an empty Profile is therefore a normal, meaningful state — not a bug. It’s the highest-signal row in the report.

Environment

Britive resolves this by matching Wiz’s resource.subscriptionId against the native id of each environment in the application’s environment tree, then formatting the winner as Name (id).

It returns empty when the role didn’t resolve to an application, or when no environment in that application has a matching native id.

Source

Source: External and Status: Unresolved travel together for the same rows.

API Reference

All endpoints require an identity with the securityadmin.security.manage permission.

Integration management

Findings

For Wiz, {app} is wiz and {findingType} is wiz-roles.

Listing integrations

curl -s -X GET "https://$BRITIVE_TENANT/api/cspm/tokens?searchText=prod" \
  -H "Authorization: TOKEN $BRITIVE_API_TOKEN"

searchText is an optional case-insensitive substring match against each integration’s name, description, or id. Omit it to list everything.

[
  {
    "app": "wiz",
    "name": "wiz-production",
    "description": "Wiz tenant for production cloud accounts",
    "ingestUrl": "https://acme.britive-app.com/wiz-ingest/cspm-3a91f0c8-52b7-4d16-9f4a-77c0de11ab34",
    "createdOn": "2026-08-07T16:22:41.913Z"
  }
]

List responses omit actionTemplate — it’s identical for every integration of the same app type. Fetch a single integration with GET /api/cspm/integrations/{nameOrId} to get it.

Querying findings

curl -s -G "https://$BRITIVE_TENANT/api/cspm/wiz/findings/wiz-roles" \
  -H "Authorization: TOKEN $BRITIVE_API_TOKEN" \
  --data-urlencode "integration=wiz-production" \
  --data-urlencode "filter=controlSeverity eq CRITICAL and resolved eq unresolved" \
  --data-urlencode "sort=sourceRoleName,asc" \
  --data-urlencode "page=0" \
  --data-urlencode "size=50"

The response wraps the rows with paging metadata:

{
  "page": 0,
  "size": 50,
  "count": 128,
  "data": [ /* WizRoleFinding objects */ ]
}

count is the total matching rows, not the number in data — use it to drive paging.

Filter Grammar

<attribute> <operator> <value> [and <attribute> <operator> <value>]...

Conditions are combined with and. There is no or and no grouping — for OR-style matching across attributes, use searchText.

Operators

Literal _ and % in values are escaped, so they match themselves rather than acting as wildcards.

Filterable attributes

These same attributes are valid for filter, sort, and searchText:

An unrecognized attribute or operator returns a validation error naming what is supported, so a typo fails loudly rather than silently returning everything.

Useful Queries

Ungoverned critical roles — the highest-priority list. Roles Wiz flagged as critical that no Britive profile governs:

filter=controlSeverity eq CRITICAL and resolved eq unresolved

Ungoverned roles in a known application — roles Britive can already see, which means you can wrap them in a profile today:

filter=resolved eq unresolved and appName sw AWS

Everything in one cloud account:

filter=sourceEnvironment co 123456789012

Findings on admin-named roles, worst first:

filter=sourceRoleName co admin&sort=controlSeverity,asc

Data Retention and Updates

Each finding is stored keyed by the integration plus the Wiz issue id. Re-sending the same issue updates the existing row rather than creating a duplicate — so as Wiz re-evaluates an issue and pushes an update, the report reflects the latest state.

Because the key includes the integration, two integrations that happen to ingest the same underlying Wiz issue id keep separate rows and never overwrite each other.

Britive does not delete findings when Wiz closes an issue unless Wiz sends an update saying so. If your Wiz rule only fires on issue creation, closed issues will persist in the report — configure the rule to fire on status changes too.

Next Steps

• Troubleshooting — when findings don’t arrive or don’t resolve
• Wiz Integration — setup and token management