Wiz

Agentless cloud security with bidirectional Issue mirroring, status sync, comment sync, and due-date sync between Wiz and Cortex XSOAR.

Utilities · Wiz

Details

IDWiz
ProviderGoogle
CategoryUtilities
From Version6.0.0
Docker Imagedemisto/python3:3.12.13.10116658
Supported ModulesAgentix XSIAM

README

Agentless, context-aware and full-stack security and compliance across AWS, Azure, GCP, OCI, Kubernetes, and other supported cloud platforms.
This integration was integrated and tested with Wiz

Configure Wiz in Cortex

Parameter Description Required  
Incident type   False ß
Service Account ID   True  
Password   True  
Authentication Endpoint Wiz Authentication Endpoint, e.g., https://auth.app.wiz.io/oauth/token False  
API Endpoint Wiz API Endpoint. Default: https://api.us1.app.wiz.io/graphql
To find your API endpoint URL:
1. Log in to Wiz, then open your user profile
2. Copy the API Endpoint URL to use here.		 True  
Incidents Fetch Interval   False  
First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)   False  
Max Issues to Fetch   False  
Use system proxy settings   False  
Fetch incidents Issue Streaming type.
Either Fetch incidents (to constantly pull Issues) or Do not fetch (to push live Issues)		 False  
Issue severity to fetch Select the severity levels of issues to fetch from Wiz. Multiple selections are allowed. Leave empty to fetch all severities. False  
Issue status to fetch Select the status of issues to fetch from Wiz. Multiple selections are allowed. False  
Issue type to fetch Select the type of issues to fetch from Wiz. Multiple selections are allowed. False  
Incident Mirror Direction Choose the mirroring direction for Wiz issues. Default is None (no mirroring). Cortex XSOAR only parameter. False  
Mirror API page size Page size for mirror API calls (1-500). All modified issues are fetched using this as the page size. False  
Tag for comment mirroring Add this tag to XSOAR war room entries to mirror them as Wiz issue notes. False  

Mirroring

The Wiz integration supports bidirectional mirroring between Wiz Issues and XSOAR incidents. Configure direction via the Incident Mirror Direction instance setting:

Direction Behavior
None Mirroring disabled. No dbotMirror* metadata is attached to fetched incidents.
Incoming Wiz → XSOAR only. Pulls remote status changes and notes into the XSOAR incident.
Outgoing XSOAR → Wiz only. Pushes XSOAR status changes, due-date changes, and tagged war room entries to the Wiz Issue.
Incoming And Outgoing Both directions active.

Mirrored fields

Field Direction Notes
Issue status Both XSOAR closed/active map to Wiz RESOLVED/OPEN. in_progress maps to IN_PROGRESS. Reopen restores OPEN.
Resolution reason Outgoing When closing in XSOAR, set resolutionReason (e.g. ISSUE_FIXED, WONT_FIX). When omitted, defaults to WONT_FIX.
Notes / comments Both Incoming: all Wiz issue notes are added as war room entries (formatted **Author** (timestamp): text). Service-account notes use **[SA] <name>**. Outgoing: only war room entries tagged with comment_tag (default comments) are pushed to Wiz.
Due date (dueAt) Outgoing Setting/clearing the XSOAR wizissueduedate field updates the Wiz Issue.

Loop prevention

Outgoing notes are prefixed with Mirrored from Cortex XSOAR and the Wiz integration filters them out on incoming sync, so mirrored notes are not echoed back into the war room.

First-sync behavior

On the first incoming sync after an incident is created in XSOAR, existing Wiz notes are not back-filled into the war room — only notes added after the first sync are mirrored. This avoids dumping the entire pre-existing note history into a fresh investigation.

Note truncation

Notes longer than 1400 characters are truncated and suffixed with ... [truncated] before being sent to the Wiz API. This applies to all mirrored notes and to the wiz-set-issue-note, wiz-resolve-issue, wiz-reject-issue, and wiz-defend-set-threat-comment commands.

Mirror engine commands

The following commands are invoked by the XSOAR mirroring engine and are not intended for manual use:

Command Purpose
get-remote-data Fetches updates for a single incident from Wiz.
get-modified-remote-data Returns the list of Wiz Issues modified since the last mirror cycle (paginated; page size = mirror_limit).
update-remote-system Pushes local XSOAR changes (status, notes, due date) back to Wiz.
get-mapping-fields Returns the schema of mappable fields. Used by the mapper UI.

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook or War Room.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

wiz-get-issue

Get the details for a Wiz Issue ID.

Base Command

wiz-get-issue

Input

Argument Name Description Required
issue_id Issue id Required

Command Example

!wiz-get-issue issue_id="12345678-1234-1234-1234-cc0a24716e0b"

wiz-get-issues

Get the issues on cloud resources.

Base Command

wiz-get-issues

Input

| Argument Name | Description | Required |
|——————-|——————————————————————————————————————————————————————| — |
| issue_type | The type of Issue to get
Expected input: TOXIC_COMBINATION, THREAT_DETECTION, CLOUD_CONFIGURATION.
The chosen type will be fetched . | Optional |
| entity_type | The type of entity to get issues for. | Optional |
| resource_id | Get Issues of a specific resource_id.
Expected input: providerId | Optional |
| severity | Get Issues of a specific severuty.
Expected input: CRITICAL, HIGH, MEDIUM, LOW or INFORMATIONAL.
The chosen severity and above will be fetched | Optional |
entity_type and resource_id are mutually exclusive.

Context Output

Path Type Description
Wiz.Manager.Issues String All Issues

Command Example

!wiz-get-issues entity_type="VIRTUAL_MACHINE"
!wiz-get-issues issue_type="THREAT_DETECTION"
!wiz-get-issues resource_id="arn:aws:ec2:us-east-2:123456789098:instance/i-0g03j4h5gd123d456"
!wiz-get-issues resource_id="arn:aws:ec2:us-east-2:123456789098:instance/i-0g03j4h5gd123d456" severity=HIGH

wiz-get-resource

Get Details of a resource. You should pass exactly one of resource_id, resource_name.
When searching by name, results are limited to 500 records.

Base Command

wiz-get-resource

Input

Argument Name Description Required
resource_id Resource provider id optional
resource_name search by name or external ID optional

Context Output

Path Type Description
Wiz.Manager.Resource String Resource details

Command Example

!wiz-get-resource resource_id="arn:aws:ec2:us-east-2:123456789098:instance/i-0g03j4h5gd123d456"
!wiz-get-resource resource_name="i-0g03j4h5gd123d456"
!wiz-get-resource resource_name="test_vm"

wiz-get-resources

Get details of multiple resources based on various filters.

Base Command

wiz-get-resources

Input

Argument Name Description Required
search Filter by free text search on cloud resource name. Optional
entity_type Filter cloud resources by specific entity types. Possible values are: ACCESS_ROLE, ACCESS_ROLE_BINDING, ACCESS_ROLE_PERMISSION, API_GATEWAY, APPLICATION, AUTHENTICATION_CONFIGURATION, BACKUP_SERVICE, BUCKET, CDN, CERTIFICATE, CICD_SERVICE, CLOUD_LOG_CONFIGURATION, CLOUD_ORGANIZATION, COMPUTE_INSTANCE_GROUP, CONFIG_MAP, CONTAINER, CONTAINER_GROUP, CONTAINER_IMAGE, CONTAINER_REGISTRY, CONTAINER_SERVICE, DAEMON_SET, DATABASE, DATA_WORKLOAD, DB_SERVER, DEPLOYMENT, DNS_RECORD, DNS_ZONE, DOMAIN, EMAIL_SERVICE, ENCRYPTION_KEY, ENDPOINT, FILE_SYSTEM_SERVICE, FIREWALL, GATEWAY, GOVERNANCE_POLICY, GOVERNANCE_POLICY_GROUP, HOSTED_APPLICATION, IAM_BINDING, IP_RANGE, KUBERNETES_CLUSTER, KUBERNETES_CRON_JOB, KUBERNETES_INGRESS, KUBERNETES_INGRESS_CONTROLLER, KUBERNETES_JOB, KUBERNETES_NETWORK_POLICY, KUBERNETES_NODE, KUBERNETES_PERSISTENT_VOLUME, KUBERNETES_PERSISTENT_VOLUME_CLAIM, KUBERNETES_POD_SECURITY_POLICY, KUBERNETES_SERVICE, KUBERNETES_STORAGE_CLASS, KUBERNETES_VOLUME, LOAD_BALANCER, MANAGED_CERTIFICATE, MANAGEMENT_SERVICE, NETWORK_ADDRESS, NETWORK_INTERFACE, NETWORK_ROUTING_RULE, NETWORK_SECURITY_RULE, PEERING, POD, PORT_RANGE, PRIVATE_ENDPOINT, PROXY, PROXY_RULE, RAW_ACCESS_POLICY, REGISTERED_DOMAIN, REPLICA_SET, RESOURCE_GROUP, SEARCH_INDEX, SECRET, SECRET_CONTAINER, SERVERLESS, SERVERLESS_PACKAGE, SERVICE_ACCOUNT, STORAGE_ACCOUNT, SUBNET, SUBSCRIPTION, SWITCH, USER_ACCOUNT, VIRTUAL_DESKTOP, VIRTUAL_MACHINE, VIRTUAL_MACHINE_IMAGE, VIRTUAL_NETWORK, VOLUME, WEB_SERVICE, DATA_WORKFLOW. Optional
subscription_external_ids Filter cloud resources according to these external subscription IDs (AWS Account, Azure Subscription, GCP Project, and OCI Compartment). You can provide multiple IDs separated by commas. Optional
provider_unique_ids Filter cloud resources according to these cloud service provider unique IDs. You can provide multiple IDs separated by commas. Optional
project_ids Filter by Wiz project IDs (comma-separated). Optional
native_types Filter by cloud-native resource types (comma-separated, e.g. aws_ec2_instance). Optional
updated_at_before Filter resources updated before this date (ISO 8601, e.g. 2024-01-01T00:00:00Z). Optional
updated_at_after Filter resources updated after this date (ISO 8601, e.g. 2024-01-01T00:00:00Z). Optional

At least one parameter must be provided.

Context Output

This command returns the raw response data from the Wiz API. The response includes resource details in JSON format.

Command Example

!wiz-get-resources search="web-server"
!wiz-get-resources entity_type="VIRTUAL_MACHINE"
!wiz-get-resources subscription_external_ids="123456789,987654321"
!wiz-get-resources provider_unique_ids="i-0g03j4h5gd123d456"
!wiz-get-resources entity_type="BUCKET" search="backup"

wiz-issue-in-progress

Set a Wiz Issue to in progress.

Base Command

wiz-issue-in-progress

Input

Argument Name Description Required
issue_id Issue id Required

Context Output

Path Type Description
Wiz.Manager.Issue String Issue details

Command Example

!wiz-issue-in-progress issue_id="12345678-1234-1234-1234-cc0a24716e0b"

wiz-reopen-issue

Re-open an Issue.

Base Command

wiz-reopen-issue

Input

Argument Name Description Required
issue_id Issue id Required
reopen_note Note for re-opening Issue Optional

Context Output

Path Type Description
Wiz.Manager.Issue String Issue details

Command Example

!wiz-reopen-issue issue_id="12345678-1234-1234-1234-cc0a24716e0b" reopen_note="still an issue"

wiz-reject-issue

Reject a Wiz Issue. Not supported for THREAT_DETECTION issues.

Base Command

wiz-reject-issue

Input

Argument Name Description Required
issue_id Issue id Required
reject_reason Rejection reason. Possible values are: FALSE_POSITIVE, EXCEPTION, WONT_FIX. Required
reject_note Note for the rejection. Notes longer than 1400 characters are truncated and suffixed with ... [truncated]. Required

Context Output

Path Type Description
Wiz.Manager.Issue String Issue details

Command Example

!wiz-reject-issue issue_id="12345678-1234-1234-1234-cc0a24716e0b" reject_reason="WONT_FIX" reject_note="this is by design"

wiz-resolve-issue

Resolve a Wiz Issue.

Base Command

wiz-resolve-issue

Input

Argument Name Description Required
issue_id Issue id Required
resolution_reason Issue resolution reason. Possible values are: OBJECT_DELETED, ISSUE_FIXED, FALSE_POSITIVE, EXCEPTION, WONT_FIX. Required
resolution_note Note to explain why the Issue has been resolved. Notes longer than 1400 characters are truncated and suffixed with ... [truncated]. Required

Context Output

Path Type Description
Wiz.Manager.Issue String Issue details

Command Example

!wiz-resolve-issue issue_id="12345678-1234-1234-1234-cc0a24716e0b" resolution_note="won't fix this issue as this is low priority" resolution_reason="WONT_FIX"

wiz-set-issue-note

Set (append) a note to an Issue.

Base Command

wiz-set-issue-note

Input

Argument Name Description Required
issue_id Issue id Required
note Note for the Issue. Will be appended to existing notes. Notes longer than 1400 characters are truncated and suffixed with ... [truncated]. Required

Command Example

!wiz-set-issue-note issue_id="12345678-1234-1234-1234-cc0a24716e0b" note="Checking with owner"

wiz-clear-issue-note

Clears a note from an Issue.

Base Command

wiz-clear-issue-note

Input

Argument Name Description Required
issue_id Issue id Required

Command Example

!wiz-clear-issue-note issue_id="12345678-1234-1234-1234-cc0a24716e0b"

wiz-get-issue-evidence

Get the evidence from an Issue.

Base Command

wiz-get-issue-evidence

Input

Argument Name Description Required
issue_id Issue id Required

Command Example

!wiz-get-issue-evidence issue_id="12345678-1234-1234-1234-cc0a24716e0b"

wiz-rescan-machine-disk

Deprecated

wiz-set-issue-due-date

Set a due date for an Issue.

Base Command

wiz-set-issue-due-date

Input

Argument Name Description Required
issue_id Issue id Required
due_at Due At Date. Format must be YYYY-MM-DD (e.g. 2026-12-31). Required

Command Example

!wiz-set-issue-due-date issue_id="12345678-1234-1234-1234-cc0a24716e0b" due_at="2022-01-20"

wiz-clear-issue-due-date

Clear a due date for an Issue.

Base Command

wiz-clear-issue-due-date

Input

Argument Name Description Required
issue_id Issue id Required

Command Example

!wiz-clear-issue-due-date issue_id="12345678-1234-1234-1234-cc0a24716e0b"

wiz-get-project-team

Get the Project Owners and Security Champions details.

Base Command

wiz-get-project-team

Input

Argument Name Description Required
project_name Project Name Required

Command Example

!wiz-get-project-team project_name="project1"

wiz-copy-to-forensics-account

Copy VM’s Volumes to a Forensics Account

Base Command

wiz-copy-to-forensics-account

Input

Argument Name Description Required
resource_id Resource Id Required

Command Example

!wiz-copy-to-forensics-account resource_id="12345678-1234-1234-1234-cc0a24716e0b"
!wiz-copy-to-forensics-account resource_id="arn:aws:ec2:us-east-1:123455563321:instance/i-05r662bfb9708a4e8"

Configuration parameters

  • incidentType — Incident type
  • credentials — Service Account ID (required)
  • auth_endpoint — Authentication Endpoint
  • api_endpoint — API Endpoint (required)
  • incidentFetchInterval — Incidents Fetch Interval
  • first_fetch — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  • max_fetch — Max Issues to Fetch
  • proxy — Use system proxy settings
  • isFetch — Fetch incidents
  • severity — Issue severity to fetch
  • status — Issue status to fetch
  • issue_type — Issue type to fetch
  • mirror_direction — Incident Mirror Direction
  • mirror_limit — Mirror API page size
  • comment_tag — Tag for comment mirroring

Commands (20)

  • get-mapping-fields

    Returns the list of fields for an incident type. Called by the mirroring engine, not for manual use.

  • get-modified-remote-data

    Get the list of incidents modified since the last update. Called by the mirroring engine, not for manual use.

  • get-remote-data

    Get remote data for a single incident. Called by the mirroring engine, not for manual use.

  • update-remote-system

    Push local changes to Wiz. Called by the mirroring engine, not for manual use.

  • wiz-clear-issue-due-date

    Clear a due date on a Wiz Issue.

  • wiz-clear-issue-note

    Clear a note from a Wiz Issue.

  • wiz-copy-to-forensics-account

    Copy VM's Volumes to a Forensics Account.

  • wiz-get-issue

    Get the details of a Wiz Issue Id.

  • wiz-get-issue-evidence

    Get the Wiz Issue evidence.

  • wiz-get-issues

    Get the Issues on cloud resources.

  • wiz-get-project-team

    Get the Project Owners and Security Champions details.

  • wiz-get-resource

    Get details of a resource.

  • wiz-get-resources

    Get details of resources.

  • wiz-issue-in-progress

    Set a Wiz Issue to in progress.

  • wiz-reject-issue

    Reject a Wiz Issue.

  • wiz-reopen-issue

    Reopen a Wiz Issue.

  • wiz-rescan-machine-disk Deprecated

    DEPRECATED.

  • wiz-resolve-issue

    Resolve a Wiz Threat Detection Issue. For non-Threat-Detection issues (Toxic Combination, Cloud Configuration, Attack Surface) use wiz-reject-issue — those types are auto-resolved by Wiz when the underlying problem is fixed and cannot be manually resolved.

  • wiz-set-issue-due-date

    Set a due date on a Wiz Issue.

  • wiz-set-issue-note

    Set a note on a Wiz Issue.

Source

Wiz.py Wiz_test.py Wiz.yml Wiz_description.md command_examples.txt
Download History Raw 
category: Utilities
provider: Google
sectionorder:
- Connect
- Collect
commonfields:
  id: Wiz
  version: -1
defaultmapperin: Wiz Mapper
configuration:
- name: incidentType
  display: Incident type
  defaultvalue: Wiz Issue
  type: 13
  required: false
  section: Collect
- display: Service Account ID
  name: credentials
  type: 9
  required: true
  section: Connect
- display: Authentication Endpoint
  name: auth_endpoint
  type: 0
  required: false
  section: Connect
- display: API Endpoint
  name: api_endpoint
  required: true
  type: 0
  defaultvalue: https://api.us1.app.wiz.io/graphql
  section: Connect
- name: incidentFetchInterval
  display: Incidents Fetch Interval
  defaultvalue: 60
  type: 19
  required: false
  advanced: true
  section: Collect
- defaultvalue: 7 days
  display: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  name: first_fetch
  type: 0
  required: false
  section: Collect
- defaultvalue: '200'
  display: Max Issues to Fetch
  name: max_fetch
  type: 0
  required: false
  section: Collect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
- name: severity
  display: Issue severity to fetch
  additionalinfo: 'Select the severity levels of issues to fetch from Wiz. Multiple selections are allowed. Leave empty to fetch all severities.'
  options:
  - INFORMATIONAL
  - LOW
  - MEDIUM
  - HIGH
  - CRITICAL
  type: 16
  required: false
  section: Collect
- name: status
  display: Issue status to fetch
  additionalinfo: 'Select the status of issues to fetch from Wiz. Multiple selections are allowed.'
  options:
  - OPEN
  - IN_PROGRESS
  - RESOLVED
  - REJECTED
  defaultvalue: OPEN,IN_PROGRESS
  type: 16
  required: false
  section: Collect
- name: issue_type
  display: Issue type to fetch
  additionalinfo: 'Select the type of issues to fetch from Wiz. Multiple selections are allowed.'
  options:
  - TOXIC_COMBINATION
  - THREAT_DETECTION
  - CLOUD_CONFIGURATION
  defaultvalue: TOXIC_COMBINATION,CLOUD_CONFIGURATION,THREAT_DETECTION
  type: 16
  required: false
  section: Collect
- name: mirror_direction
  display: Incident Mirror Direction
  defaultvalue: None
  type: 15
  options:
  - None
  - Incoming
  - Outgoing
  - Incoming And Outgoing
  required: false
  section: Collect
  additionalinfo: 'Choose the mirroring direction for Wiz issues. Default is None (no mirroring). Cortex XSOAR only parameter.'
  hidden:
  - marketplacev2
  - platform
- name: mirror_limit
  display: Mirror API page size
  defaultvalue: '50'
  type: 0
  required: false
  section: Collect
  advanced: true
  additionalinfo: 'Page size for mirror API calls (1-500). All modified issues are fetched using this as the page size.'
- name: comment_tag
  display: Tag for comment mirroring
  defaultvalue: comments
  type: 0
  required: false
  section: Collect
  advanced: true
  additionalinfo: 'Add this tag to XSOAR war room entries to mirror them as Wiz issue notes.'
description: Agentless cloud security with bidirectional Issue mirroring, status sync, comment sync, and due-date sync between Wiz and Cortex XSOAR.
display: Wiz
name: Wiz
script:
  commands:
  - name: wiz-get-issues
    description: Get the Issues on cloud resources.
    arguments:
    - description: Type of entity to get issues for.
      name: entity_type
      predefined:
      - ACCESS_ROLE
      - ACCESS_ROLE_BINDING
      - ACCESS_ROLE_PERMISSION
      - API_GATEWAY
      - APPLICATION
      - AUTHENTICATION_CONFIGURATION
      - BACKUP_SERVICE
      - BUCKET
      - CDN
      - CERTIFICATE
      - CICD_SERVICE
      - CLOUD_LOG_CONFIGURATION
      - CLOUD_ORGANIZATION
      - COMPUTE_INSTANCE_GROUP
      - CONFIG_MAP
      - CONTAINER
      - CONTAINER_GROUP
      - CONTAINER_IMAGE
      - CONTAINER_REGISTRY
      - CONTAINER_SERVICE
      - DAEMON_SET
      - DATABASE
      - DATA_WORKLOAD
      - DB_SERVER
      - DEPLOYMENT
      - DNS_RECORD
      - DNS_ZONE
      - DOMAIN
      - EMAIL_SERVICE
      - ENCRYPTION_KEY
      - ENDPOINT
      - FILE_SYSTEM_SERVICE
      - FIREWALL
      - GATEWAY
      - GOVERNANCE_POLICY
      - GOVERNANCE_POLICY_GROUP
      - HOSTED_APPLICATION
      - IAM_BINDING
      - IP_RANGE
      - KUBERNETES_CLUSTER
      - KUBERNETES_CRON_JOB
      - KUBERNETES_INGRESS
      - KUBERNETES_INGRESS_CONTROLLER
      - KUBERNETES_JOB
      - KUBERNETES_NETWORK_POLICY
      - KUBERNETES_NODE
      - KUBERNETES_PERSISTENT_VOLUME
      - KUBERNETES_PERSISTENT_VOLUME_CLAIM
      - KUBERNETES_POD_SECURITY_POLICY
      - KUBERNETES_SERVICE
      - KUBERNETES_STORAGE_CLASS
      - KUBERNETES_VOLUME
      - LOAD_BALANCER
      - MANAGED_CERTIFICATE
      - MANAGEMENT_SERVICE
      - NETWORK_ADDRESS
      - NETWORK_INTERFACE
      - NETWORK_ROUTING_RULE
      - NETWORK_SECURITY_RULE
      - PEERING
      - POD
      - PORT_RANGE
      - PRIVATE_ENDPOINT
      - PROXY
      - PROXY_RULE
      - RAW_ACCESS_POLICY
      - REGISTERED_DOMAIN
      - REPLICA_SET
      - RESOURCE_GROUP
      - SEARCH_INDEX
      - SECRET
      - SECRET_CONTAINER
      - SERVERLESS
      - SERVERLESS_PACKAGE
      - SERVICE_ACCOUNT
      - STORAGE_ACCOUNT
      - SUBNET
      - SUBSCRIPTION
      - SWITCH
      - USER_ACCOUNT
      - VIRTUAL_DESKTOP
      - VIRTUAL_MACHINE
      - VIRTUAL_MACHINE_IMAGE
      - VIRTUAL_NETWORK
      - VOLUME
      - WEB_SERVICE
      - DATA_WORKFLOW
      auto: PREDEFINED
    - description: Get Issues of a specific resource.
      name: resource_id
    - name: severity
      auto: PREDEFINED
      predefined:
      - CRITICAL
      - HIGH
      - MEDIUM
      - LOW
      - INFORMATIONAL
      description: Get Issues of a specific severity and above.
    - name: issue_type
      auto: PREDEFINED
      predefined:
      - TOXIC_COMBINATION
      - THREAT_DETECTION
      - CLOUD_CONFIGURATION
      description: Get Issues of a specific type.
    - description: Get Issues created after this date (ISO 8601, e.g. 2024-01-01T00:00:00Z). Narrows heavy queries to avoid timeouts.
      name: created_after
      required: false
    - description: Get Issues created before this date (ISO 8601, e.g. 2024-01-01T00:00:00Z).
      name: created_before
      required: false
    - description: Maximum number of Issues to return. When omitted, all matching Issues are returned. Returns the most severe Issues first.
      name: limit
      required: false
    outputs:
    - contextPath: Wiz.Manager.Issues.entitySnapshot
      description: All resource details.
      type: String
    - contextPath: Wiz.Manager.Issues.createdAt
      description: Issue created at.
      type: String
    - contextPath: Wiz.Manager.Issues.id
      description: Wiz Issue ID.
      type: String
    - contextPath: Wiz.Manager.Issues.control
      description: Control details, that created this Issue.
      type: String
    - contextPath: Wiz.Manager.Issues.severity
      description: Wiz Issue severity.
      type: String
    - contextPath: Wiz.Manager.Issues.status
      description: Wiz Issue status (open, resolved, rejected).
      type: String
    - contextPath: Wiz.Manager.Issues.note
      description: Wiz Issue note.
      type: String
  - name: wiz-get-resource
    arguments:
    - description: resource provider unique id.
      name: resource_id
      required: false
    - description: search by name or external ID.
      name: resource_name
      required: false
    description: Get details of a resource.
    outputs:
    - contextPath: Wiz.Manager.Resource.id
      description: Resource ID in Wiz.
      type: String
    - contextPath: Wiz.Manager.Resource.name
      description: Resource name.
      type: String
    - contextPath: Wiz.Manager.Resource.properties
      description: Resource properties.
      type: String
    - contextPath: Wiz.Manager.Resource.publicExposures
      description: Calculated public exposure for resource.
      type: String
    - contextPath: Wiz.Manager.Resource.type
      description: Resource type.
      type: String
    - contextPath: Wiz.Manager.Resource.userMetadata
      description: User metadata for the resource.
      type: String
  - name: wiz-get-resources
    description: Get details of resources.
    arguments:
    - description: Filter by free text search on cloud resource name.
      name: search
      required: false
    - description: Filter cloud resources according to these external subscription IDs (AWS Account, Azure Subscription, GCP Project, and OCI Compartment).
      name: subscription_external_ids
      required: false
    - description: Filter cloud resources according to these cloud service provider unique IDs.
      name: provider_unique_ids
      required: false
    - description: Filter cloud resources by specific entity types.
      name: entity_type
      predefined:
      - ACCESS_ROLE
      - ACCESS_ROLE_BINDING
      - ACCESS_ROLE_PERMISSION
      - API_GATEWAY
      - APPLICATION
      - AUTHENTICATION_CONFIGURATION
      - BACKUP_SERVICE
      - BUCKET
      - CDN
      - CERTIFICATE
      - CICD_SERVICE
      - CLOUD_LOG_CONFIGURATION
      - CLOUD_ORGANIZATION
      - COMPUTE_INSTANCE_GROUP
      - CONFIG_MAP
      - CONTAINER
      - CONTAINER_GROUP
      - CONTAINER_IMAGE
      - CONTAINER_REGISTRY
      - CONTAINER_SERVICE
      - DAEMON_SET
      - DATABASE
      - DATA_WORKLOAD
      - DB_SERVER
      - DEPLOYMENT
      - DNS_RECORD
      - DNS_ZONE
      - DOMAIN
      - EMAIL_SERVICE
      - ENCRYPTION_KEY
      - ENDPOINT
      - FILE_SYSTEM_SERVICE
      - FIREWALL
      - GATEWAY
      - GOVERNANCE_POLICY
      - GOVERNANCE_POLICY_GROUP
      - HOSTED_APPLICATION
      - IAM_BINDING
      - IP_RANGE
      - KUBERNETES_CLUSTER
      - KUBERNETES_CRON_JOB
      - KUBERNETES_INGRESS
      - KUBERNETES_INGRESS_CONTROLLER
      - KUBERNETES_JOB
      - KUBERNETES_NETWORK_POLICY
      - KUBERNETES_NODE
      - KUBERNETES_PERSISTENT_VOLUME
      - KUBERNETES_PERSISTENT_VOLUME_CLAIM
      - KUBERNETES_POD_SECURITY_POLICY
      - KUBERNETES_SERVICE
      - KUBERNETES_STORAGE_CLASS
      - KUBERNETES_VOLUME
      - LOAD_BALANCER
      - MANAGED_CERTIFICATE
      - MANAGEMENT_SERVICE
      - NETWORK_ADDRESS
      - NETWORK_INTERFACE
      - NETWORK_ROUTING_RULE
      - NETWORK_SECURITY_RULE
      - PEERING
      - POD
      - PORT_RANGE
      - PRIVATE_ENDPOINT
      - PROXY
      - PROXY_RULE
      - RAW_ACCESS_POLICY
      - REGISTERED_DOMAIN
      - REPLICA_SET
      - RESOURCE_GROUP
      - SEARCH_INDEX
      - SECRET
      - SECRET_CONTAINER
      - SERVERLESS
      - SERVERLESS_PACKAGE
      - SERVICE_ACCOUNT
      - STORAGE_ACCOUNT
      - SUBNET
      - SUBSCRIPTION
      - SWITCH
      - USER_ACCOUNT
      - VIRTUAL_DESKTOP
      - VIRTUAL_MACHINE
      - VIRTUAL_MACHINE_IMAGE
      - VIRTUAL_NETWORK
      - VOLUME
      - WEB_SERVICE
      - DATA_WORKFLOW
      auto: PREDEFINED
    - description: Filter by Wiz project IDs (comma-separated).
      name: project_ids
      required: false
    - description: Filter by cloud-native resource types (comma-separated, e.g. aws_ec2_instance).
      name: native_types
      required: false
    - description: Filter resources updated before this date (ISO 8601, e.g. 2024-01-01T00:00:00Z).
      name: updated_at_before
      required: false
    - description: Filter resources updated after this date (ISO 8601, e.g. 2024-01-01T00:00:00Z).
      name: updated_at_after
      required: false
  - name: wiz-reject-issue
    description: Reject a Wiz Issue.
    arguments:
    - name: issue_id
      required: true
      description: issue id.
    - name: reject_reason
      description: rejection reason.
      required: true
      auto: PREDEFINED
      predefined:
      - FALSE_POSITIVE
      - EXCEPTION
      - WONT_FIX
    - name: reject_note
      description: rejection note.
      required: true
  - name: wiz-reopen-issue
    description: Reopen a Wiz Issue.
    arguments:
    - name: issue_id
      description: issue id.
      required: true
    - name: reopen_note
      description: reopen note.
  - name: wiz-get-issue
    description: Get the details of a Wiz Issue Id.
    arguments:
    - name: issue_id
      description: issue id.
      required: true
  - name: wiz-resolve-issue
    description: Resolve a Wiz Threat Detection Issue. For non-Threat-Detection issues (Toxic Combination, Cloud Configuration, Attack Surface) use wiz-reject-issue — those types are auto-resolved by Wiz when the underlying problem is fixed and cannot be manually resolved.
    arguments:
    - name: issue_id
      required: true
      description: issue id.
    - name: resolution_reason
      description: resolution reason.
      required: true
      auto: PREDEFINED
      predefined:
      - OBJECT_DELETED
      - ISSUE_FIXED
      - FALSE_POSITIVE
      - EXCEPTION
      - WONT_FIX
    - name: resolution_note
      description: resolution note.
      required: true
  - name: wiz-issue-in-progress
    description: Set a Wiz Issue to in progress.
    arguments:
    - name: issue_id
      description: issue id.
      required: true
  - name: wiz-set-issue-note
    description: Set a note on a Wiz Issue.
    arguments:
    - name: issue_id
      description: issue id.
      required: true
    - name: note
      description: note.
      required: true
  - name: wiz-clear-issue-note
    description: Clear a note from a Wiz Issue.
    arguments:
    - name: issue_id
      description: issue id.
      required: true
  - name: wiz-set-issue-due-date
    description: Set a due date on a Wiz Issue.
    arguments:
    - name: issue_id
      description: issue id.
      required: true
    - name: due_at
      description: due at date. Format needs to be YYYY-MM-DD.
  - name: wiz-clear-issue-due-date
    description: Clear a due date on a Wiz Issue.
    arguments:
    - name: issue_id
      description: issue id.
      required: true
  - name: wiz-get-issue-evidence
    description: Get the Wiz Issue evidence.
    arguments:
    - name: issue_id
      description: issue id.
      required: true
  - name: wiz-get-project-team
    description: Get the Project Owners and Security Champions details.
    arguments:
    - name: project_name
      description: project name.
      required: true
  - name: wiz-rescan-machine-disk
    description: DEPRECATED.
    deprecated: true
    arguments:
    - name: vm_id
      description: vm cloud provider id.
      required: true
  - name: wiz-copy-to-forensics-account
    description: Copy VM's Volumes to a Forensics Account.
    arguments:
    - name: resource_id
      description: ID of the resource to copy its Volumes. Can be Wiz ID or provider's ID.
      required: true
  - name: get-remote-data
    description: Get remote data for a single incident. Called by the mirroring engine, not for manual use.
    arguments:
    - name: id
      description: The remote incident ID.
    - name: lastUpdate
      description: The UTC timestamp of the last update.
    outputs: []
  - name: get-modified-remote-data
    description: Get the list of incidents modified since the last update. Called by the mirroring engine, not for manual use.
    arguments:
    - name: lastUpdate
      description: The UTC timestamp of the last update.
    outputs: []
  - name: update-remote-system
    description: Push local changes to Wiz. Called by the mirroring engine, not for manual use.
    arguments:
    - name: data
      description: The incident data.
    - name: entries
      description: New entries to push.
    - name: incidentChanged
      description: Whether the incident changed.
    - name: remoteId
      description: The remote incident ID.
    outputs: []
  - name: get-mapping-fields
    description: Returns the list of fields for an incident type. Called by the mirroring engine, not for manual use.
    arguments: []
    outputs: []
  dockerimage: demisto/python3:3.12.13.10116658
  isfetch: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
  ismappable: true
  isremotesyncin: true
  isremotesyncout: true
tests:
- No tests
fromversion: 6.0.0
defaultmapperout: Wiz - Outgoing Mapper