Details

ID	`WizDefend`
Provider	Google
Category	Utilities
From Version	6.0.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

WizDefend Integration

Agentless cloud security platform for detecting and addressing cloud issues, detections, and threats.

Configure WizDefend on Cortex XSOAR

Navigate to Settings > Integrations > Servers & Services.
Search for WizDefend.
Click Add instance to create and configure a new integration instance.

Parameter	Required
Service Account ID	True
Authentication Endpoint	True
API Endpoint	True
First fetch timestamp (maximum 2 days)	False
Max Detections to Fetch	False
Minimum detection severity to fetch	False
Type of detections to fetch	False
Detection cloud account or cloud organization to fetch	False
Detection platforms to fetch	False
Cloud event origin to fetch	False
Use system proxy settings	False
Fetch incidents	False

Click Test to validate the URLs, connection, and configuration.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

wiz-defend-get-detections

Retrieve Wiz security detections based on specified filters.

Base Command

wiz-defend-get-detections

Input

Argument Name	Description	Required
creation_minutes_back	Time window in minutes to retrieve detections (range 10-600). Default is 10.	Optional
type	Type of detections to fetch. Possible values are: GENERATED THREAT, DID NOT GENERATE THREAT. Default is GENERATED THREAT.	Optional
issue_id	The internal Wiz Issue ID of the Detections.	Optional
cloud_account_or_cloud_organization	Detection cloud account or cloud organization to fetch.	Optional
origin	Cloud event origin. You can insert multiple cloud event origins in this format ORIGIN1,ORIGIN2 etc…	Optional
platform	Get Detections for cloud platform. You can insert multiple platforms in this format PLATFORM1,PLATFORM2 etc…	Optional
resource_id	Filter detections by specific resource ID.	Optional
severity	Get Detections of a specific severity and above. Possible values are: CRITICAL, HIGH, MEDIUM, LOW, INFORMATIONAL.	Optional
rule_match_id	Filter detections by rule match ID (requires valid UUID format).	Optional
rule_match_name	Filter detections by matching rule name.	Optional
project	Filter Detections by project.	Optional

Context Output

Path	Type	Description
Wiz.Manager.Detections.entitySnapshot	String	All resource details.
Wiz.Manager.Detections.createdAt	String	Detection created at.
Wiz.Manager.Detections.id	String	Wiz Detection ID.
Wiz.Manager.Detections.url	String	Wiz Detection URL.
Wiz.Manager.Detections.severity	String	Wiz Detection severity.
Wiz.Manager.Detections.status	String	Wiz Detection status.

wiz-defend-get-detection

Retrieve detailed information about a specific Wiz detection by ID.

Base Command

wiz-defend-get-detection

Input

Argument Name	Description	Required
detection_id	Wiz internal detection ID to retrieve.	Optional

Context Output

Path	Type	Description
Wiz.Manager.Detection.id	String	Detection ID in Wiz.
Wiz.Manager.Detection.severity	String	Detection severity.
Wiz.Manager.Detection.description	String	Detection description.
Wiz.Manager.Detection.createdAt	Date	Detection creation time.
Wiz.Manager.Detection.resources	String	Related resources.
Wiz.Manager.Detection.url	String	URL to the Wiz Detection in the Wiz console.

wiz-defend-get-threat

Retrieve detailed information about a specific Wiz threat by issue ID.

Base Command

wiz-defend-get-threat

Input

Argument Name	Description	Required
issue_id	Wiz internal issue ID to retrieve.	Optional

Context Output

Path	Type	Description
Wiz.Manager.Threat.id	String	Threat ID in Wiz.
Wiz.Manager.Threat.severity	String	Threat severity.
Wiz.Manager.Threat.description	String	Threat description.
Wiz.Manager.Threat.createdAt	Date	Threat creation time.
Wiz.Manager.Threat.resources	String	Related resources.
Wiz.Manager.Threat.url	String	URL to the Wiz Threat in the Wiz console.

wiz-defend-get-threats

Retrieve Wiz threats based on specified filters.

Base Command

wiz-defend-get-threats

Input

Argument Name	Description	Required
creation_days_back	Time window in days to retrieve threats (range 1-30). Default is 5.	Optional
cloud_account_or_cloud_organization	Threat cloud account or cloud organization to fetch.	Optional
platform	Get Threats for cloud platform. You can insert multiple platforms in this format PLATFORM1,PLATFORM2 etc…	Optional
resource_id	Filter threats by specific resource ID.	Optional
severity	Minimum threat severity to fetch. Possible values are: CRITICAL, HIGH, MEDIUM, LOW, INFORMATIONAL.	Optional
status	Filter threats by status (e.g., OPEN, IN_PROGRESS). Possible values are: OPEN, IN_PROGRESS, RESOLVED, REJECTED. Default is OPEN, IN_PROGRESS.	Optional
origin	Cloud event origin. You can insert multiple cloud event origins in this format ORIGIN1,ORIGIN2 etc…	Optional
project	Filter Threats by project.	Optional

Context Output

Path	Type	Description
Wiz.Manager.Threats.entitySnapshot	String	All resource details.
Wiz.Manager.Threats.createdAt	String	Threat created at.
Wiz.Manager.Threats.id	String	Wiz Threat ID.
Wiz.Manager.Threats.url	String	Wiz Threat URL.
Wiz.Manager.Threats.severity	String	Wiz Threat severity.
Wiz.Manager.Threats.status	String	Wiz Threat status.

wiz-defend-reopen-threat

Reopen a Wiz Threat.

Base Command

wiz-defend-reopen-threat

Input

Argument Name	Description	Required
issue_id	Threat issue id.	Required
reopen_note	Reopen note.	Optional

wiz-defend-resolve-threat

Resolve a Wiz Threat.

Base Command

wiz-defend-resolve-threat

Input

Argument Name	Description	Required
issue_id	Threat issue id.	Required
resolution_reason	Resolution reason. Possible values are: MALICIOUS_THREAT, NOT_MALICIOUS_THREAT, SECURITY_TEST_THREAT, PLANNED_ACTION_THREAT, INCONCLUSIVE_THREAT.	Required
resolution_note	Resolution note. Notes longer than 1400 characters are truncated and suffixed with `... [truncated]`.	Required

wiz-defend-set-threat-in-progress

Set a Wiz Threat to in progress.

Base Command

wiz-defend-set-threat-in-progress

Input

Argument Name	Description	Required
issue_id	Threat issue id.	Required

wiz-defend-set-threat-comment

Set a comment on a Wiz Threat.

Base Command

wiz-defend-set-threat-comment

Input

Argument Name	Description	Required
issue_id	Threat issue id.	Required
note	Note. Notes longer than 1400 characters are truncated and suffixed with `... [truncated]`.	Required

wiz-defend-clear-threat-comments

Clear all the comments from a Wiz Threat.

Base Command

wiz-defend-clear-threat-comments

Input

Argument Name	Description	Required
issue_id	Threat issue id.	Required

Notes

Detection description fallback

When the Wiz API returns a detection without a description, the integration auto-generates one in the form <SEVERITY> severity detection triggered by rule '<rule_name>' (ID: <rule_id>) so that XSOAR incidents always have a populated wizdetails field.

Note truncation

wiz-defend-set-threat-comment and wiz-defend-resolve-threat truncate any note input longer than 1400 characters (suffixed with ... [truncated]) to avoid Wiz API errors.

Known Limitations

Maximum fetch limit is 1000 detections per run
XSOAR fetch process has a 5-minute timeout

Troubleshooting

If you encounter issues:

Verify you created a Wiz Service Account through a Wiz integration
Ensure the Authentication and API endpoints are accessible
Review the integration logs for detailed error messages

Configuration parameters

incidentType — Incident type
credentials — Service Account ID (required)
auth_endpoint — Authentication Endpoint (required)
api_endpoint — API Endpoint (required)
incidentFetchInterval — Incidents Fetch Interval
first_fetch — First fetch timestamp (maximum 2 days)
max_fetch — Max Detections to Fetch
severity — Detection severities to fetch. (required)
type — Type of detections to fetch.
cloud_account_or_cloud_organization — Detection cloud account or cloud organization to fetch.
platform — Detection platforms to fetch.
origin — Cloud event origin to fetch.
proxy — Use system proxy settings
isFetch — Fetch incidents

Commands (9)

wiz-defend-clear-threat-comments
Clear all the comments from a Wiz Threat.
wiz-defend-get-detection
Retrieve detailed information about a specific Wiz detection by ID.
wiz-defend-get-detections
Retrieve Wiz security detections based on specified filters.
wiz-defend-get-threat
Retrieve detailed information about a specific Wiz threat by issue ID.
wiz-defend-get-threats
Retrieve Wiz threats based on specified filtering criteria.
wiz-defend-reopen-threat
Reopen a Wiz Threat.
wiz-defend-resolve-threat
Resolve a Wiz Threat.
wiz-defend-set-threat-comment
Set a comment on a Wiz Threat.
wiz-defend-set-threat-in-progress
Set a Wiz Threat to in progress.

Source

WizDefend.py WizDefend_test.py WizDefend.yml WizDefend_description.md command_examples.txt

Download History Raw

category: Utilities
provider: Google
sectionorder:
- Connect
- Collect
commonfields:
  id: WizDefend
  version: -1
defaultmapperin: WizDefend Mapper
configuration:
- name: incidentType
  display: Incident type
  defaultvalue: WizDefend Detection
  type: 13
  required: false
  section: Collect
- name: credentials
  display: Service Account ID
  type: 9
  required: true
  section: Connect
- name: auth_endpoint
  display: Authentication Endpoint
  type: 0
  required: true
  section: Connect
  defaultvalue: https://auth.app.wiz.io/oauth/token
- name: api_endpoint
  display: API Endpoint
  required: true
  type: 0
  section: Connect
- name: incidentFetchInterval
  display: Incidents Fetch Interval
  defaultvalue: 10
  type: 19
  required: false
  section: Collect
  advanced: true
- name: first_fetch
  display: First fetch timestamp (maximum 2 days)
  additionalinfo: 'Specifies how far back to retrieve detections during the first fetch. Format: <number> <time unit>, e.g., "12 hours", "1 day". Maximum allowed is 2 days.'
  type: 0
  required: false
  defaultvalue: 12 hours
  section: Collect
- name: max_fetch
  defaultvalue: '1000'
  display: Max Detections to Fetch
  type: 0
  required: false
  additionalinfo: 'Maximum number of detections to fetch per run. Note that XSOAR fetch process has a 5-minute timeout, so fetching large numbers of detections may cause timeouts. Recommended range is 10-1000.'
  section: Collect
- name: severity
  additionalinfo: 'The system will fetch detections of the selected severity level and all higher severity levels.'
  display: Detection severities to fetch.
  options:
  - Critical
  - High
  - Medium
  - Low
  defaultvalue: High,Critical
  type: 16
  required: true
  section: Collect
- name: type
  display: Type of detections to fetch.
  additionalinfo: 'Select the type of detections to fetch from Wiz. "GENERATED THREAT" fetches detections that resulted in actual threats being identified. "DID NOT GENERATE THREAT" fetches detections that matched rules but did not result in threats. Leave as "None" to fetch all detection types.'
  options:
  - None
  - GENERATED THREAT
  - DID NOT GENERATE THREAT
  defaultvalue: GENERATED THREAT
  type: 15
  required: false
  section: Collect
- name: cloud_account_or_cloud_organization
  display: Detection cloud account or cloud organization to fetch.
  type: 0
  required: false
  section: Collect
- name: platform
  display: Detection platforms to fetch.
  options:
  - AWS
  - GCP
  - Azure
  - OCI
  - Alibaba
  - vSphere
  - OpenStack
  - AKS
  - EKS
  - GKE
  - Kubernetes
  - OpenShift
  - OKE
  - Linode
  - AzureDevOps
  - GitHub
  - GitLab
  - Bitbucket
  - Terraform
  - OpenAI
  - Snowflake
  - MongoDBAtlas
  - Databricks
  - Okta
  - Cloudflare
  - Microsoft365
  - Wiz
  - ACK
  - SelfHosted
  - LKE
  type: 16
  section: Collect
- name: origin
  display: Cloud event origin to fetch.
  options:
  - WIZ_SENSOR
  - WIZ_ADMISSION_CONTROLLER
  - WIZ_FILE_INTEGRITY_MONITORING
  - AWS_GUARD_DUTY
  - AWS_CLOUDTRAIL
  - AZURE_DEFENDER_FOR_CLOUD
  - AZURE_ACTIVITY_LOGS
  - GCP_SECURITY_COMMAND_CENTER
  - GCP_AUDIT_LOGS
  - WIZ_AGENTLESS_FILE_INTEGRITY_MONITORING
  - AZURE_ACTIVE_DIRECTORY
  - GOOGLE_WORKSPACE_AUDIT_LOGS
  - WIN_SENTINEL_ONE
  - WIZ_CODE_ANALYZER
  - WIN_SALT
  - WIN_NONAME
  - WIN_CROWD_STRIKE
  - WIN_TRACEABLE
  - WIZ_CLI
  - WIZ_IDE_EXTENSION
  - WIZ_THREAT_DETECTION
  - WIZ_KUBERNETES_AUDIT_LOGS_COLLECTOR
  - WIZ_CUSTOM_INTEGRATION
  - WIN_AKAMAI_GUARDICORE
  - OKTA_SYSTEM_LOGS
  - WIN_SNOWFLAKE
  - WIN_FALCO
  - OCI_AUDIT_LOGS
  - WIZ_VCS_FETCHER
  - AWS_VPC_FLOW_LOGS
  - GITHUB_AUDIT_LOGS
  - WIN_FIRE_TAIL
  - AZURE_STORAGE_ACCOUNT
  - AZURE_KEY_VAULT
  - AWS_RESOLVER_QUERY_LOGS
  - AWS_S3_DATA_EVENTS
  - GCP_STORAGE_DATA_ACCESS_LOGS
  - AWS_CLOUDTRAIL_NETWORK_ACTIVITY
  - WIZ_BROWSER_EXTENSION
  - WIN_SALT_SECURITY
  type: 16
  required: false
  section: Collect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
description: Agentless cloud security platform for detecting and addressing cloud issues, detections, and threats.
display: WizDefend
name: WizDefend
script:
  commands:
  - name: wiz-defend-get-detections
    description: Retrieve Wiz security detections based on specified filters.
    arguments:
    - name: creation_minutes_back
      description: Time window in minutes to retrieve detections (range 10-600).
      defaultValue: 10
      required: false
    - name: type
      description: Type of detections to fetch.
      predefined:
      - GENERATED THREAT
      - DID NOT GENERATE THREAT
      defaultValue: GENERATED THREAT
      auto: PREDEFINED
    - name: issue_id
      description: The internal Wiz Issue ID of the Detections.
      required: false
    - name: cloud_account_or_cloud_organization
      description: Detection cloud account or cloud organization to fetch.
      required: false
    - name: origin
      description: Cloud event origin. You can insert multiple cloud event origins in this format ORIGIN1,ORIGIN2 etc...
      predefined:
      - WIZ_SENSOR
      - WIZ_ADMISSION_CONTROLLER
      - WIZ_FILE_INTEGRITY_MONITORING
      - AWS_GUARD_DUTY
      - AWS_CLOUDTRAIL
      - AZURE_DEFENDER_FOR_CLOUD
      - AZURE_ACTIVITY_LOGS
      - GCP_SECURITY_COMMAND_CENTER
      - GCP_AUDIT_LOGS
      - WIZ_AGENTLESS_FILE_INTEGRITY_MONITORING
      - AZURE_ACTIVE_DIRECTORY
      - GOOGLE_WORKSPACE_AUDIT_LOGS
      - WIN_SENTINEL_ONE
      - WIZ_CODE_ANALYZER
      - WIN_SALT
      - WIN_NONAME
      - WIN_CROWD_STRIKE
      - WIN_TRACEABLE
      - WIZ_CLI
      - WIZ_IDE_EXTENSION
      - WIZ_THREAT_DETECTION
      - WIZ_KUBERNETES_AUDIT_LOGS_COLLECTOR
      - WIZ_CUSTOM_INTEGRATION
      - WIN_AKAMAI_GUARDICORE
      - OKTA_SYSTEM_LOGS
      - WIN_SNOWFLAKE
      - WIN_FALCO
      - OCI_AUDIT_LOGS
      - WIZ_VCS_FETCHER
      - AWS_VPC_FLOW_LOGS
      - GITHUB_AUDIT_LOGS
      - WIN_FIRE_TAIL
      - AZURE_STORAGE_ACCOUNT
      - AZURE_KEY_VAULT
      - AWS_RESOLVER_QUERY_LOGS
      - AWS_S3_DATA_EVENTS
      - GCP_STORAGE_DATA_ACCESS_LOGS
      - AWS_CLOUDTRAIL_NETWORK_ACTIVITY
      - WIZ_BROWSER_EXTENSION
      - WIN_SALT_SECURITY
      auto: PREDEFINED
    - name: platform
      description: Get Detections for cloud platform. You can insert multiple platforms in this format PLATFORM1,PLATFORM2 etc...
      predefined:
      - AWS
      - GCP
      - Azure
      - OCI
      - Alibaba
      - vSphere
      - OpenStack
      - AKS
      - EKS
      - GKE
      - Kubernetes
      - OpenShift
      - OKE
      - Linode
      - AzureDevOps
      - GitHub
      - GitLab
      - Bitbucket
      - Terraform
      - OpenAI
      - Snowflake
      - MongoDBAtlas
      - Databricks
      - Okta
      - Cloudflare
      - Microsoft365
      - Wiz
      - ACK
      - SelfHosted
      - LKE
      auto: PREDEFINED
      isArray: true
    - name: resource_id
      description: Filter detections by specific resource ID.
    - name: severity
      auto: PREDEFINED
      predefined:
      - CRITICAL
      - HIGH
      - MEDIUM
      - LOW
      - INFORMATIONAL
      description: Get Detections of a specific severity and above.
    - name: rule_match_id
      description: Filter detections by rule match ID (requires valid UUID format).
      required: false
    - name: rule_match_name
      description: Filter detections by matching rule name.
      required: false
    - name: project
      description: Filter Detections by project.
      required: false
    outputs:
    - contextPath: Wiz.Manager.Detections.entitySnapshot
      description: All resource details.
      type: String
    - contextPath: Wiz.Manager.Detections.createdAt
      description: Detection created at.
      type: String
    - contextPath: Wiz.Manager.Detections.id
      description: Wiz Detection ID.
      type: String
    - contextPath: Wiz.Manager.Detections.url
      description: Wiz Detection URL.
      type: String
    - contextPath: Wiz.Manager.Detections.severity
      description: Wiz Detection severity.
      type: String
    - contextPath: Wiz.Manager.Detections.status
      description: Wiz Detection status.
      type: String
  - name: wiz-defend-get-detection
    description: Retrieve detailed information about a specific Wiz detection by ID.
    arguments:
    - description: Wiz internal detection ID to retrieve.
      name: detection_id
      isArray: true
      required: false
    outputs:
    - contextPath: Wiz.Manager.Detection.id
      description: Detection ID in Wiz.
      type: String
    - contextPath: Wiz.Manager.Detection.severity
      description: Detection severity.
      type: String
    - contextPath: Wiz.Manager.Detection.description
      description: Detection description.
      type: String
    - contextPath: Wiz.Manager.Detection.createdAt
      description: Detection creation time.
      type: Date
    - contextPath: Wiz.Manager.Detection.resources
      description: Related resources.
      type: String
    - contextPath: Wiz.Manager.Detection.url
      description: URL to the Wiz Detection in the Wiz console.
      type: String
  - name: wiz-defend-get-threat
    description: Retrieve detailed information about a specific Wiz threat by issue ID.
    arguments:
    - description: Wiz internal issue ID to retrieve.
      name: issue_id
      isArray: true
      required: false
    outputs:
    - contextPath: Wiz.Manager.Threat.id
      description: Threat ID in Wiz.
      type: String
    - contextPath: Wiz.Manager.Threat.severity
      description: Threat severity.
      type: String
    - contextPath: Wiz.Manager.Threat.description
      description: Threat description.
      type: String
    - contextPath: Wiz.Manager.Threat.createdAt
      description: Threat creation time.
      type: Date
    - contextPath: Wiz.Manager.Threat.resources
      description: Related resources.
      type: String
    - contextPath: Wiz.Manager.Threat.url
      description: URL to the Wiz Threat in the Wiz console.
      type: String
  - name: wiz-defend-get-threats
    description: Retrieve Wiz threats based on specified filtering criteria.
    arguments:
    - name: creation_days_back
      description: Number of days back to get threats  (range 1-30).
      defaultValue: 5
      required: false
    - name: resource_id
      description: Filter threats by Wiz resource ID.
      required: false
    - name: platform
      description: Get Threats for cloud platform. You can insert multiple platforms in this format PLATFORM1,PLATFORM2 etc...
      predefined:
      - AWS
      - GCP
      - Azure
      - OCI
      - Alibaba
      - vSphere
      - OpenStack
      - AKS
      - EKS
      - GKE
      - Kubernetes
      - OpenShift
      - OKE
      - Linode
      - AzureDevOps
      - GitHub
      - GitLab
      - Bitbucket
      - Terraform
      - OpenAI
      - Snowflake
      - MongoDBAtlas
      - Databricks
      - Okta
      - Cloudflare
      - Microsoft365
      - Wiz
      - ACK
      - SelfHosted
      - LKE
      auto: PREDEFINED
      isArray: true
    - name: cloud_account_or_cloud_organization
      description: Threat cloud account or cloud organization to fetch.
      required: false
    - name: severity
      auto: PREDEFINED
      predefined:
      - CRITICAL
      - HIGH
      - MEDIUM
      - LOW
      - INFORMATIONAL
      description: Minimum threat severity to fetch.
    - name: status
      auto: PREDEFINED
      predefined:
      - OPEN
      - IN_PROGRESS
      - RESOLVED
      - REJECTED
      isArray: true
      defaultValue: OPEN, IN_PROGRESS
      description: Filter threats by status (e.g., OPEN, IN_PROGRESS).
    - name: origin
      description: Cloud event origin. You can insert multiple cloud event origins in this format ORIGIN1,ORIGIN2 etc...
      predefined:
      - WIZ_SENSOR
      - WIZ_ADMISSION_CONTROLLER
      - WIZ_FILE_INTEGRITY_MONITORING
      - AWS_GUARD_DUTY
      - AWS_CLOUDTRAIL
      - AZURE_DEFENDER_FOR_CLOUD
      - AZURE_ACTIVITY_LOGS
      - GCP_SECURITY_COMMAND_CENTER
      - GCP_AUDIT_LOGS
      - WIZ_AGENTLESS_FILE_INTEGRITY_MONITORING
      - AZURE_ACTIVE_DIRECTORY
      - GOOGLE_WORKSPACE_AUDIT_LOGS
      - WIN_SENTINEL_ONE
      - WIZ_CODE_ANALYZER
      - WIN_SALT
      - WIN_NONAME
      - WIN_CROWD_STRIKE
      - WIN_TRACEABLE
      - WIZ_CLI
      - WIZ_IDE_EXTENSION
      - WIZ_THREAT_DETECTION
      - WIZ_KUBERNETES_AUDIT_LOGS_COLLECTOR
      - WIZ_CUSTOM_INTEGRATION
      - WIN_AKAMAI_GUARDICORE
      - OKTA_SYSTEM_LOGS
      - WIN_SNOWFLAKE
      - WIN_FALCO
      - OCI_AUDIT_LOGS
      - WIZ_VCS_FETCHER
      - AWS_VPC_FLOW_LOGS
      - GITHUB_AUDIT_LOGS
      - WIN_FIRE_TAIL
      - AZURE_STORAGE_ACCOUNT
      - AZURE_KEY_VAULT
      - AWS_RESOLVER_QUERY_LOGS
      - AWS_S3_DATA_EVENTS
      - GCP_STORAGE_DATA_ACCESS_LOGS
      - AWS_CLOUDTRAIL_NETWORK_ACTIVITY
      - WIZ_BROWSER_EXTENSION
      - WIN_SALT_SECURITY
      auto: PREDEFINED
    - name: project
      description: Filter Threats by project.
      required: false
    outputs:
    - contextPath: Wiz.Manager.Threats.entitySnapshot
      description: All resource details.
      type: String
    - contextPath: Wiz.Manager.Threats.createdAt
      description: Threat created at.
      type: String
    - contextPath: Wiz.Manager.Threats.id
      description: Wiz Threat ID.
      type: String
    - contextPath: Wiz.Manager.Threats.url
      description: Wiz Threat URL.
      type: String
    - contextPath: Wiz.Manager.Threats.severity
      description: Wiz Threat severity.
      type: String
    - contextPath: Wiz.Manager.Threats.status
      description: Wiz Threat status.
      type: String
  - name: wiz-defend-reopen-threat
    description: Reopen a Wiz Threat.
    arguments:
    - name: issue_id
      description: threat issue id.
      required: true
    - name: reopen_note
      description: reopen note.
      required: false
  - name: wiz-defend-resolve-threat
    description: Resolve a Wiz Threat.
    arguments:
    - name: issue_id
      required: true
      description: threat issue id.
    - name: resolution_reason
      description: resolution reason.
      required: true
      auto: PREDEFINED
      predefined:
      - MALICIOUS_THREAT
      - NOT_MALICIOUS_THREAT
      - SECURITY_TEST_THREAT
      - PLANNED_ACTION_THREAT
      - INCONCLUSIVE_THREAT
    - name: resolution_note
      description: resolution note.
      required: true
  - name: wiz-defend-set-threat-in-progress
    description: Set a Wiz Threat to in progress.
    arguments:
    - name: issue_id
      description: threat issue id.
      required: true
  - name: wiz-defend-set-threat-comment
    description: Set a comment on a Wiz Threat.
    arguments:
    - name: issue_id
      description: threat issue id.
      required: true
    - name: note
      description: note.
      required: true
  - name: wiz-defend-clear-threat-comments
    description: Clear all the comments from a Wiz Threat.
    arguments:
    - name: issue_id
      description: threat issue id.
      required: true
  dockerimage: demisto/python3:3.12.13.10116658
  isfetch: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
tests:
- No tests
fromversion: 6.0.0