Assess WizDefend Detections

Playbook to assess Wiz Detections from the WizDefend integration

Wiz · 9 tasks · 0 inputs · 0 outputs

Details

ID	`Assess WizDefend Detections`
From Version	6.0.0
Tasks	9

README

Assess WizDefend Detections

This playbook provides a structured workflow for assessing and investigating Wiz Detections that come from the WizDefend integration. The playbook includes built-in validation to ensure proper integration setup before execution and automatically retrieves associated threat information when available.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

WizDefend

Scripts

This playbook does not use any scripts.

Commands

wiz-get-detection
wiz-get-threat

Prerequisites

Before running this playbook, ensure:

WizDefend integration is properly configured and enabled
The incident contains a valid wizdetectionid field
Proper API connectivity to Wiz services

Playbook Inputs

The playbook automatically uses the following incident fields:

incident.wizdetectionid - The Wiz detection ID (required)

There are no manual inputs required for this playbook.

Playbook Outputs

The playbook outputs the following context data:

Wiz.Manager.Detection - Detailed detection information
Wiz.Manager.Threat - Associated threat information (if available)

Playbook Image

Assess Wiz Detections

Workflow

The playbook follows these steps:

1. Pre-execution Validation

Integration Check: Verifies that the WizDefend integration is enabled and active
Data Validation: Confirms that a detection ID exists in the incident

2. Detection Investigation (if validation passes)

Get Detection Information: Retrieves detailed information about the specific detection using the detection ID
Issue ID Check: Examines the detection response to determine if there’s an associated threat (issue ID)

3. Threat Investigation (conditional)

Get Threat Information: If an issue ID is found in the detection, retrieves detailed threat information using wiz-get-threat

4. Analysis and Documentation

Assess Impact: Guides the analyst through impact assessment based on detection severity, threat information (if available), and affected resources

5. Completion

Done: Structured end point indicating playbook completion

Logic Flow

The playbook uses intelligent conditional logic:

Detection Retrieved → Check for Issue ID
                   ├─ Issue ID Found → Get Threat Info → Assess Impact
                   └─ No Issue ID → Skip Threat → Assess Impact

Error Handling

The playbook gracefully handles the following scenarios:

WizDefend integration not enabled or configured
Missing detection ID in the incident
API connectivity issues
Detections without associated threats/issues

If prerequisites are not met, the playbook will skip the investigation steps and proceed directly to completion, preventing errors and ensuring smooth operation.

Context Data Usage

The playbook leverages XSOAR context data effectively:

Detection information is stored in Wiz.Manager.Detection
The issue ID is accessed via Wiz.Manager.Detection.issue.id
Threat information (when retrieved) is stored in Wiz.Manager.Threat

Best Practices

Ensure the WizDefend integration is properly configured before enabling incident fetching
Verify that incident mapping includes the required field (wizdetectionid)
Review and customize the impact assessment steps based on your organization’s processes
Consider the additional context provided by threat information when available for more comprehensive analysis

Customization Options

The playbook can be extended with additional tasks such as:

Automated Enrichment: Add tasks to enrich detection/threat data with external sources
Risk Scoring: Implement custom risk scoring based on detection and threat characteristics
Assign Owner: Add logic to automatically assign incidents based on detection type, severity, or threat presence
Document Investigation: Add structured documentation steps for investigation findings
Escalation Logic: Include conditional paths based on threat severity or detection type
Integration with SIEM: Add tasks to query additional security tools for context
Automated Response: Include containment or remediation steps for specific detection/threat types

Technical Notes

The playbook uses the Wiz.Manager.Detection.issue.id context path to check for associated threats
Conditional logic ensures efficient execution by only retrieving threat data when relevant
All API calls are wrapped in proper error handling through the integration validation steps

Commands used

wiz-defend-get-detection wiz-defend-get-threat wiz-defend-set-threat-in-progress

Flowchart

Source

playbook-Assess_WizDefend_Detections.yml

Download History Raw

id: Assess WizDefend Detections
name: Assess WizDefend Detections
description: Playbook to assess Wiz Detections from the WizDefend integration
starttaskid: "0"
tasks:
  "0":
    id: "0"
    type: start
    task:
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
      id: 5f7d6811-ad26-42ca-b47e-ee8a12f9bb7f
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    taskid: 5f7d6811-ad26-42ca-b47e-ee8a12f9bb7f
  "1":
    id: "1"
    type: condition
    task:
      description: Is WizDefend integration enabled?
      id: 7f8e9d10-1234-5678-9abc-def012345678
      version: -1
      name: Is WizDefend integration enabled?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "8"
      "yes":
      - "2"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: WizDefend
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                accessor: brand
            iscontext: true
    view: |-
      {
        "position": {
          "x": 50,
          "y": 195
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    taskid: 7f8e9d10-1234-5678-9abc-def012345678
  "2":
    id: "2"
    type: condition
    task:
      description: Is there a detection ID to process?
      id: 8a9b0c1d-2345-6789-abcd-ef0123456789
      version: -1
      name: Is there a detection ID to process?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "8"
      "yes":
      - "3"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              simple: incident.wizdetectionid
            iscontext: true
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    taskid: 8a9b0c1d-2345-6789-abcd-ef0123456789
  "3":
    id: "3"
    type: regular
    task:
      version: -1
      name: Get Detection Information
      description: Get detailed information about the specific detection
      script: WizDefend|||wiz-defend-get-detection
      type: regular
      iscommand: true
      brand: WizDefend
      id: 7f90d8e3-df5a-4cbc-b8a5-fb63a59d7c48
    nexttasks:
      '#none#':
      - "4"
    scriptarguments:
      detection_id:
        simple: ${incident.wizdetectionid}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 275,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    taskid: 7f90d8e3-df5a-4cbc-b8a5-fb63a59d7c48
  "4":
    id: "4"
    type: condition
    task:
      description: Does the detection have an associated threat (issue ID)?
      id: 4b5c6d7e-8901-2345-6789-abcdef012345
      version: -1
      name: Does detection have an issue ID?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "6"
      "yes":
      - "5"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: Wiz.Manager.Detection.issue
                accessor: id
            iscontext: true
    view: |-
      {
        "position": {
          "x": 275,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    taskid: 4b5c6d7e-8901-2345-6789-abcdef012345
  "5":
    id: "5"
    type: regular
    task:
      version: -1
      name: Get Threat Information
      description: Get detailed threat information using the issue ID from the detection
      script: WizDefend|||wiz-defend-get-threat
      type: regular
      iscommand: true
      brand: WizDefend
      id: 5c6d7e8f-9012-3456-789a-bcdef0123456
    nexttasks:
      '#none#':
      - "6"
    scriptarguments:
      issue_id:
        complex:
          root: Wiz.Manager.Detection.issue
          accessor: id
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 387.5,
          "y": 895
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    taskid: 5c6d7e8f-9012-3456-789a-bcdef0123456
  "6":
    id: "6"
    type: condition
    task:
      version: -1
      name: "Set Threat Status to In Progress ?"
      description: |-
        Do you want to set this threat to "In Progress" status in Wiz?
        
        **Detection Details:**
        - ID: ${Wiz.Manager.Detection.id}
        - Severity: ${Wiz.Manager.Detection.severity}
        - Status: ${Wiz.Manager.Detection.status}
        
        **Threat Details:**
        - ID: ${Wiz.Manager.Threat.id}
        - Severity: ${Wiz.Manager.Threat.severity}
        - Status: ${Wiz.Manager.Threat.status}
      type: condition
      iscommand: false
      brand: ""
      id: fabde172-2e4d-4548-a4e3-f67ecb646c90
    nexttasks:
      "Yes":
      - "7"
      "No":
      - "8"
    separatecontext: false
    defaultassigneecomplex: {}
    form:
      questions:
      - id: "0"
        label: ""
        labelarg:
          simple: "Do you want to set this threat to In Progress status?"
        required: false
        gridcolumns: []
        defaultrows: []
        type: singleSelect
        options: []
        optionsarg:
        - simple: "Yes"
        - simple: "No"
        fieldassociated: ""
        placeholder: ""
        tooltip: "Choose Yes to set the threat to In Progress in Wiz, or No to skip this action"
        readonly: false
      title: "Set Threat Status Confirmation"
      description: "Review the detection details above and choose whether to set the threat to In Progress status in Wiz"
      sender: ""
      expired: false
      totalanswers: 0
    view: |-
      {
        "position": {
          "x": 275,
          "y": 1070
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    taskid: fabde172-2e4d-4548-a4e3-f67ecb646c90
  "7":
    id: "7"
    type: regular
    task:
      version: -1
      name: "Set Threat Status to In Progress"
      description: Set the Wiz threat to in-progress status
      script: WizDefend|||wiz-defend-set-threat-in-progress
      type: regular
      iscommand: true
      brand: WizDefend
      id: a1b2c3d4-5e6f-7890-abcd-ef1234567890
    nexttasks:
      '#none#':
      - "8"
    scriptarguments:
      issue_id:
        complex:
          root: Wiz.Manager.Detection.issue
          accessor: id
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 387.5,
          "y": 1245
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    taskid: a1b2c3d4-5e6f-7890-abcd-ef1234567890
  "8":
    id: "8"
    type: title
    task:
      id: 9e8f7g6h-3456-789a-bcde-f01234567890
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1420
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    taskid: 9e8f7g6h-3456-789a-bcde-f01234567890
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 1435,
        "width": 717.5,
        "x": 50,
        "y": 50
      }
    }
  }
inputs: []
outputs: []
fromversion: 6.0.0
version: -1
tests:
- No tests