WizDefend

Agentless cloud security platform for detecting and addressing cloud issues, detections, and threats.

Utilities · Wiz

Details

IDWizDefend
ProviderGoogle
CategoryUtilities
From Version6.0.0
Docker Imagedemisto/python3:3.12.13.10116658
Supported ModulesAgentix XSIAM

README

WizDefend Integration

Agentless cloud security platform for detecting and addressing cloud issues, detections, and threats.

Configure WizDefend on Cortex XSOAR

  1. Navigate to Settings > Integrations > Servers & Services.
  2. Search for WizDefend.
  3. Click Add instance to create and configure a new integration instance.
Parameter Required
Service Account ID True
Authentication Endpoint True
API Endpoint True
First fetch timestamp (maximum 2 days) False
Max Detections to Fetch False
Minimum detection severity to fetch False
Type of detections to fetch False
Detection cloud account or cloud organization to fetch False
Detection platforms to fetch False
Cloud event origin to fetch False
Use system proxy settings False
Fetch incidents False
  1. Click Test to validate the URLs, connection, and configuration.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

wiz-defend-get-detections

Retrieve Wiz security detections based on specified filters.

Base Command

wiz-defend-get-detections

Input

Argument Name Description Required
creation_minutes_back Time window in minutes to retrieve detections (range 10-600). Default is 10. Optional
type Type of detections to fetch. Possible values are: GENERATED THREAT, DID NOT GENERATE THREAT. Default is GENERATED THREAT. Optional
issue_id The internal Wiz Issue ID of the Detections. Optional
cloud_account_or_cloud_organization Detection cloud account or cloud organization to fetch. Optional
origin Cloud event origin. You can insert multiple cloud event origins in this format ORIGIN1,ORIGIN2 etc… Optional
platform Get Detections for cloud platform. You can insert multiple platforms in this format PLATFORM1,PLATFORM2 etc… Optional
resource_id Filter detections by specific resource ID. Optional
severity Get Detections of a specific severity and above. Possible values are: CRITICAL, HIGH, MEDIUM, LOW, INFORMATIONAL. Optional
rule_match_id Filter detections by rule match ID (requires valid UUID format). Optional
rule_match_name Filter detections by matching rule name. Optional
project Filter Detections by project. Optional

Context Output

Path Type Description
Wiz.Manager.Detections.entitySnapshot String All resource details.
Wiz.Manager.Detections.createdAt String Detection created at.
Wiz.Manager.Detections.id String Wiz Detection ID.
Wiz.Manager.Detections.url String Wiz Detection URL.
Wiz.Manager.Detections.severity String Wiz Detection severity.
Wiz.Manager.Detections.status String Wiz Detection status.

wiz-defend-get-detection

Retrieve detailed information about a specific Wiz detection by ID.

Base Command

wiz-defend-get-detection

Input

Argument Name Description Required
detection_id Wiz internal detection ID to retrieve. Optional

Context Output

Path Type Description
Wiz.Manager.Detection.id String Detection ID in Wiz.
Wiz.Manager.Detection.severity String Detection severity.
Wiz.Manager.Detection.description String Detection description.
Wiz.Manager.Detection.createdAt Date Detection creation time.
Wiz.Manager.Detection.resources String Related resources.
Wiz.Manager.Detection.url String URL to the Wiz Detection in the Wiz console.

wiz-defend-get-threat

Retrieve detailed information about a specific Wiz threat by issue ID.

Base Command

wiz-defend-get-threat

Input

Argument Name Description Required
issue_id Wiz internal issue ID to retrieve. Optional

Context Output

Path Type Description
Wiz.Manager.Threat.id String Threat ID in Wiz.
Wiz.Manager.Threat.severity String Threat severity.
Wiz.Manager.Threat.description String Threat description.
Wiz.Manager.Threat.createdAt Date Threat creation time.
Wiz.Manager.Threat.resources String Related resources.
Wiz.Manager.Threat.url String URL to the Wiz Threat in the Wiz console.

wiz-defend-get-threats

Retrieve Wiz threats based on specified filters.

Base Command

wiz-defend-get-threats

Input

Argument Name Description Required
creation_days_back Time window in days to retrieve threats (range 1-30). Default is 5. Optional
cloud_account_or_cloud_organization Threat cloud account or cloud organization to fetch. Optional
platform Get Threats for cloud platform. You can insert multiple platforms in this format PLATFORM1,PLATFORM2 etc… Optional
resource_id Filter threats by specific resource ID. Optional
severity Minimum threat severity to fetch. Possible values are: CRITICAL, HIGH, MEDIUM, LOW, INFORMATIONAL. Optional
status Filter threats by status (e.g., OPEN, IN_PROGRESS). Possible values are: OPEN, IN_PROGRESS, RESOLVED, REJECTED. Default is OPEN, IN_PROGRESS. Optional
origin Cloud event origin. You can insert multiple cloud event origins in this format ORIGIN1,ORIGIN2 etc… Optional
project Filter Threats by project. Optional

Context Output

Path Type Description
Wiz.Manager.Threats.entitySnapshot String All resource details.
Wiz.Manager.Threats.createdAt String Threat created at.
Wiz.Manager.Threats.id String Wiz Threat ID.
Wiz.Manager.Threats.url String Wiz Threat URL.
Wiz.Manager.Threats.severity String Wiz Threat severity.
Wiz.Manager.Threats.status String Wiz Threat status.

wiz-defend-reopen-threat

Reopen a Wiz Threat.

Base Command

wiz-defend-reopen-threat

Input

Argument Name Description Required
issue_id Threat issue id. Required
reopen_note Reopen note. Optional

wiz-defend-resolve-threat

Resolve a Wiz Threat.

Base Command

wiz-defend-resolve-threat

Input

Argument Name Description Required
issue_id Threat issue id. Required
resolution_reason Resolution reason. Possible values are: MALICIOUS_THREAT, NOT_MALICIOUS_THREAT, SECURITY_TEST_THREAT, PLANNED_ACTION_THREAT, INCONCLUSIVE_THREAT. Required
resolution_note Resolution note. Notes longer than 1400 characters are truncated and suffixed with ... [truncated]. Required

wiz-defend-set-threat-in-progress

Set a Wiz Threat to in progress.

Base Command

wiz-defend-set-threat-in-progress

Input

Argument Name Description Required
issue_id Threat issue id. Required

wiz-defend-set-threat-comment

Set a comment on a Wiz Threat.

Base Command

wiz-defend-set-threat-comment

Input

Argument Name Description Required
issue_id Threat issue id. Required
note Note. Notes longer than 1400 characters are truncated and suffixed with ... [truncated]. Required

wiz-defend-clear-threat-comments

Clear all the comments from a Wiz Threat.

Base Command

wiz-defend-clear-threat-comments

Input

Argument Name Description Required
issue_id Threat issue id. Required

Notes

Detection description fallback

When the Wiz API returns a detection without a description, the integration auto-generates one in the form <SEVERITY> severity detection triggered by rule '<rule_name>' (ID: <rule_id>) so that XSOAR incidents always have a populated wizdetails field.

Note truncation

wiz-defend-set-threat-comment and wiz-defend-resolve-threat truncate any note input longer than 1400 characters (suffixed with ... [truncated]) to avoid Wiz API errors.

Known Limitations

  • Maximum fetch limit is 1000 detections per run
  • XSOAR fetch process has a 5-minute timeout

Troubleshooting

If you encounter issues:

  1. Verify you created a Wiz Service Account through a Wiz integration
  2. Ensure the Authentication and API endpoints are accessible
  3. Review the integration logs for detailed error messages

Configuration parameters

  • incidentType — Incident type
  • credentials — Service Account ID (required)
  • auth_endpoint — Authentication Endpoint (required)
  • api_endpoint — API Endpoint (required)
  • incidentFetchInterval — Incidents Fetch Interval
  • first_fetch — First fetch timestamp (maximum 2 days)
  • max_fetch — Max Detections to Fetch
  • severity — Detection severities to fetch. (required)
  • type — Type of detections to fetch.
  • cloud_account_or_cloud_organization — Detection cloud account or cloud organization to fetch.
  • platform — Detection platforms to fetch.
  • origin — Cloud event origin to fetch.
  • proxy — Use system proxy settings
  • isFetch — Fetch incidents

Commands (9)

  • wiz-defend-clear-threat-comments

    Clear all the comments from a Wiz Threat.

  • wiz-defend-get-detection

    Retrieve detailed information about a specific Wiz detection by ID.

  • wiz-defend-get-detections

    Retrieve Wiz security detections based on specified filters.

  • wiz-defend-get-threat

    Retrieve detailed information about a specific Wiz threat by issue ID.

  • wiz-defend-get-threats

    Retrieve Wiz threats based on specified filtering criteria.

  • wiz-defend-reopen-threat

    Reopen a Wiz Threat.

  • wiz-defend-resolve-threat

    Resolve a Wiz Threat.

  • wiz-defend-set-threat-comment

    Set a comment on a Wiz Threat.

  • wiz-defend-set-threat-in-progress

    Set a Wiz Threat to in progress.

Source

WizDefend.py WizDefend_test.py WizDefend.yml WizDefend_description.md command_examples.txt
Download History Raw 
!wiz-defend-get-detection detection_id="12345678-1234-1234-1234-d25e16359c19"

!wiz-defend-get-detections severity=CRITICAL

!wiz-defend-get-detections type="GENERATED THREAT"

!wiz-defend-get-detections platform="AWS"
!wiz-defend-get-detections platform="AWS,Azure,GCP"

!wiz-defend-get-detections origin="WIZ_SENSOR"
!wiz-defend-get-detections origin="WIZ_SENSOR,AWS_GUARD_DUTY"

!wiz-defend-get-detections resource_id="arn:aws:ec2:us-east-2:123456789098:instance/i-0g03j4h5gd123d456"
!wiz-defend-get-detections resource_id="i-0g03j4h5gd123d456"

!wiz-defend-get-detections rule_match_id="12345678-1234-1234-1234-3792e8a03318"
!wiz-defend-get-detections rule_match_name="My-rule-name"

!wiz-defend-get-detections project="production-project"

!wiz-defend-get-detections cloud_account_or_cloud_organization="12345678-1234-1234-1234-12345678abcd"

!wiz-defend-get-detections severity=CRITICAL platform="AWS" creation_minutes_back="60"
!wiz-defend-get-detections type="GENERATED THREAT" platform="Azure" severity=HIGH
!wiz-defend-get-detections origin="WIZ_SENSOR" resource_id="i-0g03j4h5gd123d456" creation_minutes_back="120"
!wiz-defend-get-detections type="GENERATED THREAT" platform="AWS,Azure,GCP" severity=CRITICAL
!wiz-defend-get-detections severity=CRITICAL platform="AWS" creation_minutes_back="60"
!wiz-defend-get-detections resource_id="arn:aws:ec2:us-east-2:123456789098:instance/i-0g03j4h5gd123d456" creation_minutes_back="600"
!wiz-defend-get-detections origin="AWS_GUARD_DUTY" severity=HIGH

!wiz-defend-get-threat issue_id="12345678-1234-1234-1234-d25e16359c19"

!wiz-defend-get-threats severity=CRITICAL

!wiz-defend-get-threats status="OPEN"
!wiz-defend-get-threats status="OPEN,IN_PROGRESS"

!wiz-defend-get-threats platform="AWS"
!wiz-defend-get-threats platform="AWS,Azure,GCP"

!wiz-defend-get-threats origin="WIZ_SENSOR"
!wiz-defend-get-threats origin="WIZ_SENSOR,AWS_GUARD_DUTY"

!wiz-defend-get-threats resource_id="arn:aws:ec2:us-east-2:123456789098:instance/i-0g03j4h5gd123d456"

!wiz-defend-get-threats creation_days_back="30"

!wiz-defend-get-threats project="production-project"

!wiz-defend-get-threats cloud_account_or_cloud_organization="12345678-1234-1234-1234-12345678abcd"

!wiz-defend-get-threats severity=CRITICAL platform="AWS" creation_days_back="30"
!wiz-defend-get-threats severity=HIGH status="OPEN,IN_PROGRESS" platform="Azure"
!wiz-defend-get-threats origin="WIZ_SENSOR" resource_id="i-0g03j4h5gd123d456" creation_days_back="15"
!wiz-defend-get-threats platform="AWS,Azure,GCP" cloud_account_or_cloud_organization="12345678-1234-1234-1234-12345678abcd"

!wiz-defend-resolve-threat issue_id="12345678-1234-1234-1234-cc0a24716e0b" resolution_reason="MALICIOUS_THREAT" resolution_note="Issue has been resolved"

!wiz-defend-reopen-threat issue_id="12345678-1234-1234-1234-cc0a24716e0b"
!wiz-defend-reopen-threat issue_id="12345678-1234-1234-1234-cc0a24716e0b" reopen_note="still an issue"

!wiz-defend-set-threat-in-progress issue_id="12345678-1234-1234-1234-cc0a24716e0b"

!wiz-defend-set-threat-comment issue_id="12345678-1234-1234-1234-cc0a24716e0b" note="Checking with owner"

!wiz-defend-clear-threat-comments issue_id="12345678-1234-1234-1234-cc0a24716e0b"