Wiz

Agentless cloud security with bidirectional Issue mirroring, status sync, comment sync, and due-date sync between Wiz and Cortex XSOAR.

Utilities · Wiz

Details

IDWiz
ProviderGoogle
CategoryUtilities
From Version6.0.0
Docker Imagedemisto/python3:3.12.13.10116658
Supported ModulesAgentix XSIAM

README

Agentless, context-aware and full-stack security and compliance across AWS, Azure, GCP, OCI, Kubernetes, and other supported cloud platforms.
This integration was integrated and tested with Wiz

Configure Wiz in Cortex

Parameter Description Required  
Incident type   False ß
Service Account ID   True  
Password   True  
Authentication Endpoint Wiz Authentication Endpoint, e.g., https://auth.app.wiz.io/oauth/token False  
API Endpoint Wiz API Endpoint. Default: https://api.us1.app.wiz.io/graphql
To find your API endpoint URL:
1. Log in to Wiz, then open your user profile
2. Copy the API Endpoint URL to use here.		 True  
Incidents Fetch Interval   False  
First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)   False  
Max Issues to Fetch   False  
Use system proxy settings   False  
Fetch incidents Issue Streaming type.
Either Fetch incidents (to constantly pull Issues) or Do not fetch (to push live Issues)		 False  
Issue severity to fetch Select the severity levels of issues to fetch from Wiz. Multiple selections are allowed. Leave empty to fetch all severities. False  
Issue status to fetch Select the status of issues to fetch from Wiz. Multiple selections are allowed. False  
Issue type to fetch Select the type of issues to fetch from Wiz. Multiple selections are allowed. False  
Incident Mirror Direction Choose the mirroring direction for Wiz issues. Default is None (no mirroring). Cortex XSOAR only parameter. False  
Mirror API page size Page size for mirror API calls (1-500). All modified issues are fetched using this as the page size. False  
Tag for comment mirroring Add this tag to XSOAR war room entries to mirror them as Wiz issue notes. False  

Mirroring

The Wiz integration supports bidirectional mirroring between Wiz Issues and XSOAR incidents. Configure direction via the Incident Mirror Direction instance setting:

Direction Behavior
None Mirroring disabled. No dbotMirror* metadata is attached to fetched incidents.
Incoming Wiz → XSOAR only. Pulls remote status changes and notes into the XSOAR incident.
Outgoing XSOAR → Wiz only. Pushes XSOAR status changes, due-date changes, and tagged war room entries to the Wiz Issue.
Incoming And Outgoing Both directions active.

Mirrored fields

Field Direction Notes
Issue status Both XSOAR closed/active map to Wiz RESOLVED/OPEN. in_progress maps to IN_PROGRESS. Reopen restores OPEN.
Resolution reason Outgoing When closing in XSOAR, set resolutionReason (e.g. ISSUE_FIXED, WONT_FIX). When omitted, defaults to WONT_FIX.
Notes / comments Both Incoming: all Wiz issue notes are added as war room entries (formatted **Author** (timestamp): text). Service-account notes use **[SA] <name>**. Outgoing: only war room entries tagged with comment_tag (default comments) are pushed to Wiz.
Due date (dueAt) Outgoing Setting/clearing the XSOAR wizissueduedate field updates the Wiz Issue.

Loop prevention

Outgoing notes are prefixed with Mirrored from Cortex XSOAR and the Wiz integration filters them out on incoming sync, so mirrored notes are not echoed back into the war room.

First-sync behavior

On the first incoming sync after an incident is created in XSOAR, existing Wiz notes are not back-filled into the war room — only notes added after the first sync are mirrored. This avoids dumping the entire pre-existing note history into a fresh investigation.

Note truncation

Notes longer than 1400 characters are truncated and suffixed with ... [truncated] before being sent to the Wiz API. This applies to all mirrored notes and to the wiz-set-issue-note, wiz-resolve-issue, wiz-reject-issue, and wiz-defend-set-threat-comment commands.

Mirror engine commands

The following commands are invoked by the XSOAR mirroring engine and are not intended for manual use:

Command Purpose
get-remote-data Fetches updates for a single incident from Wiz.
get-modified-remote-data Returns the list of Wiz Issues modified since the last mirror cycle (paginated; page size = mirror_limit).
update-remote-system Pushes local XSOAR changes (status, notes, due date) back to Wiz.
get-mapping-fields Returns the schema of mappable fields. Used by the mapper UI.

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook or War Room.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

wiz-get-issue

Get the details for a Wiz Issue ID.

Base Command

wiz-get-issue

Input

Argument Name Description Required
issue_id Issue id Required

Command Example

!wiz-get-issue issue_id="12345678-1234-1234-1234-cc0a24716e0b"

wiz-get-issues

Get the issues on cloud resources.

Base Command

wiz-get-issues

Input

| Argument Name | Description | Required |
|——————-|——————————————————————————————————————————————————————| — |
| issue_type | The type of Issue to get
Expected input: TOXIC_COMBINATION, THREAT_DETECTION, CLOUD_CONFIGURATION.
The chosen type will be fetched . | Optional |
| entity_type | The type of entity to get issues for. | Optional |
| resource_id | Get Issues of a specific resource_id.
Expected input: providerId | Optional |
| severity | Get Issues of a specific severuty.
Expected input: CRITICAL, HIGH, MEDIUM, LOW or INFORMATIONAL.
The chosen severity and above will be fetched | Optional |
entity_type and resource_id are mutually exclusive.

Context Output

Path Type Description
Wiz.Manager.Issues String All Issues

Command Example

!wiz-get-issues entity_type="VIRTUAL_MACHINE"
!wiz-get-issues issue_type="THREAT_DETECTION"
!wiz-get-issues resource_id="arn:aws:ec2:us-east-2:123456789098:instance/i-0g03j4h5gd123d456"
!wiz-get-issues resource_id="arn:aws:ec2:us-east-2:123456789098:instance/i-0g03j4h5gd123d456" severity=HIGH

wiz-get-resource

Get Details of a resource. You should pass exactly one of resource_id, resource_name.
When searching by name, results are limited to 500 records.

Base Command

wiz-get-resource

Input

Argument Name Description Required
resource_id Resource provider id optional
resource_name search by name or external ID optional

Context Output

Path Type Description
Wiz.Manager.Resource String Resource details

Command Example

!wiz-get-resource resource_id="arn:aws:ec2:us-east-2:123456789098:instance/i-0g03j4h5gd123d456"
!wiz-get-resource resource_name="i-0g03j4h5gd123d456"
!wiz-get-resource resource_name="test_vm"

wiz-get-resources

Get details of multiple resources based on various filters.

Base Command

wiz-get-resources

Input

Argument Name Description Required
search Filter by free text search on cloud resource name. Optional
entity_type Filter cloud resources by specific entity types. Possible values are: ACCESS_ROLE, ACCESS_ROLE_BINDING, ACCESS_ROLE_PERMISSION, API_GATEWAY, APPLICATION, AUTHENTICATION_CONFIGURATION, BACKUP_SERVICE, BUCKET, CDN, CERTIFICATE, CICD_SERVICE, CLOUD_LOG_CONFIGURATION, CLOUD_ORGANIZATION, COMPUTE_INSTANCE_GROUP, CONFIG_MAP, CONTAINER, CONTAINER_GROUP, CONTAINER_IMAGE, CONTAINER_REGISTRY, CONTAINER_SERVICE, DAEMON_SET, DATABASE, DATA_WORKLOAD, DB_SERVER, DEPLOYMENT, DNS_RECORD, DNS_ZONE, DOMAIN, EMAIL_SERVICE, ENCRYPTION_KEY, ENDPOINT, FILE_SYSTEM_SERVICE, FIREWALL, GATEWAY, GOVERNANCE_POLICY, GOVERNANCE_POLICY_GROUP, HOSTED_APPLICATION, IAM_BINDING, IP_RANGE, KUBERNETES_CLUSTER, KUBERNETES_CRON_JOB, KUBERNETES_INGRESS, KUBERNETES_INGRESS_CONTROLLER, KUBERNETES_JOB, KUBERNETES_NETWORK_POLICY, KUBERNETES_NODE, KUBERNETES_PERSISTENT_VOLUME, KUBERNETES_PERSISTENT_VOLUME_CLAIM, KUBERNETES_POD_SECURITY_POLICY, KUBERNETES_SERVICE, KUBERNETES_STORAGE_CLASS, KUBERNETES_VOLUME, LOAD_BALANCER, MANAGED_CERTIFICATE, MANAGEMENT_SERVICE, NETWORK_ADDRESS, NETWORK_INTERFACE, NETWORK_ROUTING_RULE, NETWORK_SECURITY_RULE, PEERING, POD, PORT_RANGE, PRIVATE_ENDPOINT, PROXY, PROXY_RULE, RAW_ACCESS_POLICY, REGISTERED_DOMAIN, REPLICA_SET, RESOURCE_GROUP, SEARCH_INDEX, SECRET, SECRET_CONTAINER, SERVERLESS, SERVERLESS_PACKAGE, SERVICE_ACCOUNT, STORAGE_ACCOUNT, SUBNET, SUBSCRIPTION, SWITCH, USER_ACCOUNT, VIRTUAL_DESKTOP, VIRTUAL_MACHINE, VIRTUAL_MACHINE_IMAGE, VIRTUAL_NETWORK, VOLUME, WEB_SERVICE, DATA_WORKFLOW. Optional
subscription_external_ids Filter cloud resources according to these external subscription IDs (AWS Account, Azure Subscription, GCP Project, and OCI Compartment). You can provide multiple IDs separated by commas. Optional
provider_unique_ids Filter cloud resources according to these cloud service provider unique IDs. You can provide multiple IDs separated by commas. Optional
project_ids Filter by Wiz project IDs (comma-separated). Optional
native_types Filter by cloud-native resource types (comma-separated, e.g. aws_ec2_instance). Optional
updated_at_before Filter resources updated before this date (ISO 8601, e.g. 2024-01-01T00:00:00Z). Optional
updated_at_after Filter resources updated after this date (ISO 8601, e.g. 2024-01-01T00:00:00Z). Optional

At least one parameter must be provided.

Context Output

This command returns the raw response data from the Wiz API. The response includes resource details in JSON format.

Command Example

!wiz-get-resources search="web-server"
!wiz-get-resources entity_type="VIRTUAL_MACHINE"
!wiz-get-resources subscription_external_ids="123456789,987654321"
!wiz-get-resources provider_unique_ids="i-0g03j4h5gd123d456"
!wiz-get-resources entity_type="BUCKET" search="backup"

wiz-issue-in-progress

Set a Wiz Issue to in progress.

Base Command

wiz-issue-in-progress

Input

Argument Name Description Required
issue_id Issue id Required

Context Output

Path Type Description
Wiz.Manager.Issue String Issue details

Command Example

!wiz-issue-in-progress issue_id="12345678-1234-1234-1234-cc0a24716e0b"

wiz-reopen-issue

Re-open an Issue.

Base Command

wiz-reopen-issue

Input

Argument Name Description Required
issue_id Issue id Required
reopen_note Note for re-opening Issue Optional

Context Output

Path Type Description
Wiz.Manager.Issue String Issue details

Command Example

!wiz-reopen-issue issue_id="12345678-1234-1234-1234-cc0a24716e0b" reopen_note="still an issue"

wiz-reject-issue

Reject a Wiz Issue. Not supported for THREAT_DETECTION issues.

Base Command

wiz-reject-issue

Input

Argument Name Description Required
issue_id Issue id Required
reject_reason Rejection reason. Possible values are: FALSE_POSITIVE, EXCEPTION, WONT_FIX. Required
reject_note Note for the rejection. Notes longer than 1400 characters are truncated and suffixed with ... [truncated]. Required

Context Output

Path Type Description
Wiz.Manager.Issue String Issue details

Command Example

!wiz-reject-issue issue_id="12345678-1234-1234-1234-cc0a24716e0b" reject_reason="WONT_FIX" reject_note="this is by design"

wiz-resolve-issue

Resolve a Wiz Issue.

Base Command

wiz-resolve-issue

Input

Argument Name Description Required
issue_id Issue id Required
resolution_reason Issue resolution reason. Possible values are: OBJECT_DELETED, ISSUE_FIXED, FALSE_POSITIVE, EXCEPTION, WONT_FIX. Required
resolution_note Note to explain why the Issue has been resolved. Notes longer than 1400 characters are truncated and suffixed with ... [truncated]. Required

Context Output

Path Type Description
Wiz.Manager.Issue String Issue details

Command Example

!wiz-resolve-issue issue_id="12345678-1234-1234-1234-cc0a24716e0b" resolution_note="won't fix this issue as this is low priority" resolution_reason="WONT_FIX"

wiz-set-issue-note

Set (append) a note to an Issue.

Base Command

wiz-set-issue-note

Input

Argument Name Description Required
issue_id Issue id Required
note Note for the Issue. Will be appended to existing notes. Notes longer than 1400 characters are truncated and suffixed with ... [truncated]. Required

Command Example

!wiz-set-issue-note issue_id="12345678-1234-1234-1234-cc0a24716e0b" note="Checking with owner"

wiz-clear-issue-note

Clears a note from an Issue.

Base Command

wiz-clear-issue-note

Input

Argument Name Description Required
issue_id Issue id Required

Command Example

!wiz-clear-issue-note issue_id="12345678-1234-1234-1234-cc0a24716e0b"

wiz-get-issue-evidence

Get the evidence from an Issue.

Base Command

wiz-get-issue-evidence

Input

Argument Name Description Required
issue_id Issue id Required

Command Example

!wiz-get-issue-evidence issue_id="12345678-1234-1234-1234-cc0a24716e0b"

wiz-rescan-machine-disk

Deprecated

wiz-set-issue-due-date

Set a due date for an Issue.

Base Command

wiz-set-issue-due-date

Input

Argument Name Description Required
issue_id Issue id Required
due_at Due At Date. Format must be YYYY-MM-DD (e.g. 2026-12-31). Required

Command Example

!wiz-set-issue-due-date issue_id="12345678-1234-1234-1234-cc0a24716e0b" due_at="2022-01-20"

wiz-clear-issue-due-date

Clear a due date for an Issue.

Base Command

wiz-clear-issue-due-date

Input

Argument Name Description Required
issue_id Issue id Required

Command Example

!wiz-clear-issue-due-date issue_id="12345678-1234-1234-1234-cc0a24716e0b"

wiz-get-project-team

Get the Project Owners and Security Champions details.

Base Command

wiz-get-project-team

Input

Argument Name Description Required
project_name Project Name Required

Command Example

!wiz-get-project-team project_name="project1"

wiz-copy-to-forensics-account

Copy VM’s Volumes to a Forensics Account

Base Command

wiz-copy-to-forensics-account

Input

Argument Name Description Required
resource_id Resource Id Required

Command Example

!wiz-copy-to-forensics-account resource_id="12345678-1234-1234-1234-cc0a24716e0b"
!wiz-copy-to-forensics-account resource_id="arn:aws:ec2:us-east-1:123455563321:instance/i-05r662bfb9708a4e8"

Configuration parameters

  • incidentType — Incident type
  • credentials — Service Account ID (required)
  • auth_endpoint — Authentication Endpoint
  • api_endpoint — API Endpoint (required)
  • incidentFetchInterval — Incidents Fetch Interval
  • first_fetch — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  • max_fetch — Max Issues to Fetch
  • proxy — Use system proxy settings
  • isFetch — Fetch incidents
  • severity — Issue severity to fetch
  • status — Issue status to fetch
  • issue_type — Issue type to fetch
  • mirror_direction — Incident Mirror Direction
  • mirror_limit — Mirror API page size
  • comment_tag — Tag for comment mirroring

Commands (20)

  • get-mapping-fields

    Returns the list of fields for an incident type. Called by the mirroring engine, not for manual use.

  • get-modified-remote-data

    Get the list of incidents modified since the last update. Called by the mirroring engine, not for manual use.

  • get-remote-data

    Get remote data for a single incident. Called by the mirroring engine, not for manual use.

  • update-remote-system

    Push local changes to Wiz. Called by the mirroring engine, not for manual use.

  • wiz-clear-issue-due-date

    Clear a due date on a Wiz Issue.

  • wiz-clear-issue-note

    Clear a note from a Wiz Issue.

  • wiz-copy-to-forensics-account

    Copy VM's Volumes to a Forensics Account.

  • wiz-get-issue

    Get the details of a Wiz Issue Id.

  • wiz-get-issue-evidence

    Get the Wiz Issue evidence.

  • wiz-get-issues

    Get the Issues on cloud resources.

  • wiz-get-project-team

    Get the Project Owners and Security Champions details.

  • wiz-get-resource

    Get details of a resource.

  • wiz-get-resources

    Get details of resources.

  • wiz-issue-in-progress

    Set a Wiz Issue to in progress.

  • wiz-reject-issue

    Reject a Wiz Issue.

  • wiz-reopen-issue

    Reopen a Wiz Issue.

  • wiz-rescan-machine-disk Deprecated

    DEPRECATED.

  • wiz-resolve-issue

    Resolve a Wiz Threat Detection Issue. For non-Threat-Detection issues (Toxic Combination, Cloud Configuration, Attack Surface) use wiz-reject-issue — those types are auto-resolved by Wiz when the underlying problem is fixed and cannot be manually resolved.

  • wiz-set-issue-due-date

    Set a due date on a Wiz Issue.

  • wiz-set-issue-note

    Set a note on a Wiz Issue.

Source

Wiz.py Wiz_test.py Wiz.yml Wiz_description.md command_examples.txt
Download History Raw 
!wiz-get-resource resource_id="arn:aws:ec2:us-east-2:123456789098:instance/i-0g03j4h5gd123d456"
!wiz-get-resource resource_name="i-0g03j4h5gd123d456"
!wiz-get-resource resource_name="test_vm"

!wiz-get-issue issue_id="12345678-1234-1234-1234-cc0a24716e0b"

!wiz-get-issues entity_type="VIRTUAL_MACHINE"
!wiz-get-issues issue_type="TOXIC_COMBINATION"
!wiz-get-issues resource_id="arn:aws:ec2:us-east-2:123456789098:instance/i-0g03j4h5gd123d456"
!wiz-get-issues resource_id="arn:aws:ec2:us-east-2:123456789098:instance/i-0g03j4h5gd123d456" severity=HIGH

!wiz-issue-in-progress issue_id="12345678-1234-1234-1234-cc0a24716e0b"

!wiz-reopen-issue issue_id="12345678-1234-1234-1234-cc0a24716e0b" reopen-note="still an issue"

!wiz-reject-issue issue_id="12345678-1234-1234-1234-cc0a24716e0b" reject_reason="WONT_FIX" reject_note="this is by design"

!wiz-set-issue-note issue_id="12345678-1234-1234-1234-cc0a24716e0b" note="Checking with owner"

!wiz-clear-issue-note issue_id="12345678-1234-1234-1234-cc0a24716e0b"

!wiz-get-issue-evidence issue_id="12345678-1234-1234-1234-cc0a24716e0b"

!wiz-set-issue-due-date issue_id="12345678-1234-1234-1234-cc0a24716e0b" due_at="2022-01-20"

!wiz-clear-issue-due-date issue_id="12345678-1234-1234-1234-cc0a24716e0b"

!wiz-get-project-team project_name="project1"

!wiz-resolve-issue issue_id="12345678-1234-1234-1234-cc0a24716e0b" resolution_note="won't fix this issue as this is low priority" resolution_reason="WONT_FIX"

!wiz-copy-to-forensics-account resource_id="12345678-1234-1234-1234-cc0a24716e0b"
!wiz-copy-to-forensics-account resource_id="arn:aws:ec2:us-east-1:123455563321:instance/i-05r662bfb9708a4e8"