Wiz

Agentless cloud security with bidirectional Issue mirroring, status sync, comment sync, and due-date sync between Wiz and Cortex XSOAR.

Utilities · Wiz

Configuration parameters

  • incidentType — Incident type
  • credentials — Service Account ID (required)
  • auth_endpoint — Authentication Endpoint
  • api_endpoint — API Endpoint (required)
  • incidentFetchInterval — Incidents Fetch Interval
  • first_fetch — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  • max_fetch — Max Issues to Fetch
  • proxy — Use system proxy settings
  • isFetch — Fetch incidents
  • severity — Issue severity to fetch
  • status — Issue status to fetch
  • issue_type — Issue type to fetch
  • mirror_direction — Incident Mirror Direction
  • mirror_limit — Mirror API page size
  • comment_tag — Tag for comment mirroring

Commands (20)

  • get-mapping-fields

    Returns the list of fields for an incident type. Called by the mirroring engine, not for manual use.

  • get-modified-remote-data

    Get the list of incidents modified since the last update. Called by the mirroring engine, not for manual use.

  • get-remote-data

    Get remote data for a single incident. Called by the mirroring engine, not for manual use.

  • update-remote-system

    Push local changes to Wiz. Called by the mirroring engine, not for manual use.

  • wiz-clear-issue-due-date

    Clear a due date on a Wiz Issue.

  • wiz-clear-issue-note

    Clear a note from a Wiz Issue.

  • wiz-copy-to-forensics-account

    Copy VM's Volumes to a Forensics Account.

  • wiz-get-issue

    Get the details of a Wiz Issue Id.

  • wiz-get-issue-evidence

    Get the Wiz Issue evidence.

  • wiz-get-issues

    Get the Issues on cloud resources.

  • wiz-get-project-team

    Get the Project Owners and Security Champions details.

  • wiz-get-resource

    Get details of a resource.

  • wiz-get-resources

    Get details of resources.

  • wiz-issue-in-progress

    Set a Wiz Issue to in progress.

  • wiz-reject-issue

    Reject a Wiz Issue.

  • wiz-reopen-issue

    Reopen a Wiz Issue.

  • wiz-rescan-machine-disk Deprecated

    DEPRECATED.

  • wiz-resolve-issue

    Resolve a Wiz Threat Detection Issue. For non-Threat-Detection issues (Toxic Combination, Cloud Configuration, Attack Surface) use wiz-reject-issue — those types are auto-resolved by Wiz when the underlying problem is fixed and cannot be manually resolved.

  • wiz-set-issue-due-date

    Set a due date on a Wiz Issue.

  • wiz-set-issue-note

    Set a note on a Wiz Issue.