category: Utilities
provider: Google
sectionorder:
- Connect
- Collect
commonfields:
  id: Wiz
  version: -1
defaultmapperin: Wiz Mapper
configuration:
- name: incidentType
  display: Incident type
  defaultvalue: Wiz Issue
  type: 13
  required: false
  section: Collect
- display: Service Account ID
  name: credentials
  type: 9
  required: true
  section: Connect
- display: Authentication Endpoint
  name: auth_endpoint
  type: 0
  required: false
  section: Connect
- display: API Endpoint
  name: api_endpoint
  required: true
  type: 0
  defaultvalue: https://api.us1.app.wiz.io/graphql
  section: Connect
- name: incidentFetchInterval
  display: Incidents Fetch Interval
  defaultvalue: 60
  type: 19
  required: false
  advanced: true
  section: Collect
- defaultvalue: 7 days
  display: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  name: first_fetch
  type: 0
  required: false
  section: Collect
- defaultvalue: '200'
  display: Max Issues to Fetch
  name: max_fetch
  type: 0
  required: false
  section: Collect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
- name: severity
  display: Issue severity to fetch
  additionalinfo: 'Select the severity levels of issues to fetch from Wiz. Multiple selections are allowed. Leave empty to fetch all severities.'
  options:
  - INFORMATIONAL
  - LOW
  - MEDIUM
  - HIGH
  - CRITICAL
  type: 16
  required: false
  section: Collect
- name: status
  display: Issue status to fetch
  additionalinfo: 'Select the status of issues to fetch from Wiz. Multiple selections are allowed.'
  options:
  - OPEN
  - IN_PROGRESS
  - RESOLVED
  - REJECTED
  defaultvalue: OPEN,IN_PROGRESS
  type: 16
  required: false
  section: Collect
- name: issue_type
  display: Issue type to fetch
  additionalinfo: 'Select the type of issues to fetch from Wiz. Multiple selections are allowed.'
  options:
  - TOXIC_COMBINATION
  - THREAT_DETECTION
  - CLOUD_CONFIGURATION
  defaultvalue: TOXIC_COMBINATION,CLOUD_CONFIGURATION,THREAT_DETECTION
  type: 16
  required: false
  section: Collect
- name: mirror_direction
  display: Incident Mirror Direction
  defaultvalue: None
  type: 15
  options:
  - None
  - Incoming
  - Outgoing
  - Incoming And Outgoing
  required: false
  section: Collect
  additionalinfo: 'Choose the mirroring direction for Wiz issues. Default is None (no mirroring). Cortex XSOAR only parameter.'
  hidden:
  - marketplacev2
  - platform
- name: mirror_limit
  display: Mirror API page size
  defaultvalue: '50'
  type: 0
  required: false
  section: Collect
  advanced: true
  additionalinfo: 'Page size for mirror API calls (1-500). All modified issues are fetched using this as the page size.'
- name: comment_tag
  display: Tag for comment mirroring
  defaultvalue: comments
  type: 0
  required: false
  section: Collect
  advanced: true
  additionalinfo: 'Add this tag to XSOAR war room entries to mirror them as Wiz issue notes.'
description: Agentless cloud security with bidirectional Issue mirroring, status sync, comment sync, and due-date sync between Wiz and Cortex XSOAR.
display: Wiz
name: Wiz
script:
  commands:
  - name: wiz-get-issues
    description: Get the Issues on cloud resources.
    arguments:
    - description: Type of entity to get issues for.
      name: entity_type
      predefined:
      - ACCESS_ROLE
      - ACCESS_ROLE_BINDING
      - ACCESS_ROLE_PERMISSION
      - API_GATEWAY
      - APPLICATION
      - AUTHENTICATION_CONFIGURATION
      - BACKUP_SERVICE
      - BUCKET
      - CDN
      - CERTIFICATE
      - CICD_SERVICE
      - CLOUD_LOG_CONFIGURATION
      - CLOUD_ORGANIZATION
      - COMPUTE_INSTANCE_GROUP
      - CONFIG_MAP
      - CONTAINER
      - CONTAINER_GROUP
      - CONTAINER_IMAGE
      - CONTAINER_REGISTRY
      - CONTAINER_SERVICE
      - DAEMON_SET
      - DATABASE
      - DATA_WORKLOAD
      - DB_SERVER
      - DEPLOYMENT
      - DNS_RECORD
      - DNS_ZONE
      - DOMAIN
      - EMAIL_SERVICE
      - ENCRYPTION_KEY
      - ENDPOINT
      - FILE_SYSTEM_SERVICE
      - FIREWALL
      - GATEWAY
      - GOVERNANCE_POLICY
      - GOVERNANCE_POLICY_GROUP
      - HOSTED_APPLICATION
      - IAM_BINDING
      - IP_RANGE
      - KUBERNETES_CLUSTER
      - KUBERNETES_CRON_JOB
      - KUBERNETES_INGRESS
      - KUBERNETES_INGRESS_CONTROLLER
      - KUBERNETES_JOB
      - KUBERNETES_NETWORK_POLICY
      - KUBERNETES_NODE
      - KUBERNETES_PERSISTENT_VOLUME
      - KUBERNETES_PERSISTENT_VOLUME_CLAIM
      - KUBERNETES_POD_SECURITY_POLICY
      - KUBERNETES_SERVICE
      - KUBERNETES_STORAGE_CLASS
      - KUBERNETES_VOLUME
      - LOAD_BALANCER
      - MANAGED_CERTIFICATE
      - MANAGEMENT_SERVICE
      - NETWORK_ADDRESS
      - NETWORK_INTERFACE
      - NETWORK_ROUTING_RULE
      - NETWORK_SECURITY_RULE
      - PEERING
      - POD
      - PORT_RANGE
      - PRIVATE_ENDPOINT
      - PROXY
      - PROXY_RULE
      - RAW_ACCESS_POLICY
      - REGISTERED_DOMAIN
      - REPLICA_SET
      - RESOURCE_GROUP
      - SEARCH_INDEX
      - SECRET
      - SECRET_CONTAINER
      - SERVERLESS
      - SERVERLESS_PACKAGE
      - SERVICE_ACCOUNT
      - STORAGE_ACCOUNT
      - SUBNET
      - SUBSCRIPTION
      - SWITCH
      - USER_ACCOUNT
      - VIRTUAL_DESKTOP
      - VIRTUAL_MACHINE
      - VIRTUAL_MACHINE_IMAGE
      - VIRTUAL_NETWORK
      - VOLUME
      - WEB_SERVICE
      - DATA_WORKFLOW
      auto: PREDEFINED
    - description: Get Issues of a specific resource.
      name: resource_id
    - name: severity
      auto: PREDEFINED
      predefined:
      - CRITICAL
      - HIGH
      - MEDIUM
      - LOW
      - INFORMATIONAL
      description: Get Issues of a specific severity and above.
    - name: issue_type
      auto: PREDEFINED
      predefined:
      - TOXIC_COMBINATION
      - THREAT_DETECTION
      - CLOUD_CONFIGURATION
      description: Get Issues of a specific type.
    - description: Get Issues created after this date (ISO 8601, e.g. 2024-01-01T00:00:00Z). Narrows heavy queries to avoid timeouts.
      name: created_after
      required: false
    - description: Get Issues created before this date (ISO 8601, e.g. 2024-01-01T00:00:00Z).
      name: created_before
      required: false
    - description: Maximum number of Issues to return. When omitted, all matching Issues are returned. Returns the most severe Issues first.
      name: limit
      required: false
    outputs:
    - contextPath: Wiz.Manager.Issues.entitySnapshot
      description: All resource details.
      type: String
    - contextPath: Wiz.Manager.Issues.createdAt
      description: Issue created at.
      type: String
    - contextPath: Wiz.Manager.Issues.id
      description: Wiz Issue ID.
      type: String
    - contextPath: Wiz.Manager.Issues.control
      description: Control details, that created this Issue.
      type: String
    - contextPath: Wiz.Manager.Issues.severity
      description: Wiz Issue severity.
      type: String
    - contextPath: Wiz.Manager.Issues.status
      description: Wiz Issue status (open, resolved, rejected).
      type: String
    - contextPath: Wiz.Manager.Issues.note
      description: Wiz Issue note.
      type: String
  - name: wiz-get-resource
    arguments:
    - description: resource provider unique id.
      name: resource_id
      required: false
    - description: search by name or external ID.
      name: resource_name
      required: false
    description: Get details of a resource.
    outputs:
    - contextPath: Wiz.Manager.Resource.id
      description: Resource ID in Wiz.
      type: String
    - contextPath: Wiz.Manager.Resource.name
      description: Resource name.
      type: String
    - contextPath: Wiz.Manager.Resource.properties
      description: Resource properties.
      type: String
    - contextPath: Wiz.Manager.Resource.publicExposures
      description: Calculated public exposure for resource.
      type: String
    - contextPath: Wiz.Manager.Resource.type
      description: Resource type.
      type: String
    - contextPath: Wiz.Manager.Resource.userMetadata
      description: User metadata for the resource.
      type: String
  - name: wiz-get-resources
    description: Get details of resources.
    arguments:
    - description: Filter by free text search on cloud resource name.
      name: search
      required: false
    - description: Filter cloud resources according to these external subscription IDs (AWS Account, Azure Subscription, GCP Project, and OCI Compartment).
      name: subscription_external_ids
      required: false
    - description: Filter cloud resources according to these cloud service provider unique IDs.
      name: provider_unique_ids
      required: false
    - description: Filter cloud resources by specific entity types.
      name: entity_type
      predefined:
      - ACCESS_ROLE
      - ACCESS_ROLE_BINDING
      - ACCESS_ROLE_PERMISSION
      - API_GATEWAY
      - APPLICATION
      - AUTHENTICATION_CONFIGURATION
      - BACKUP_SERVICE
      - BUCKET
      - CDN
      - CERTIFICATE
      - CICD_SERVICE
      - CLOUD_LOG_CONFIGURATION
      - CLOUD_ORGANIZATION
      - COMPUTE_INSTANCE_GROUP
      - CONFIG_MAP
      - CONTAINER
      - CONTAINER_GROUP
      - CONTAINER_IMAGE
      - CONTAINER_REGISTRY
      - CONTAINER_SERVICE
      - DAEMON_SET
      - DATABASE
      - DATA_WORKLOAD
      - DB_SERVER
      - DEPLOYMENT
      - DNS_RECORD
      - DNS_ZONE
      - DOMAIN
      - EMAIL_SERVICE
      - ENCRYPTION_KEY
      - ENDPOINT
      - FILE_SYSTEM_SERVICE
      - FIREWALL
      - GATEWAY
      - GOVERNANCE_POLICY
      - GOVERNANCE_POLICY_GROUP
      - HOSTED_APPLICATION
      - IAM_BINDING
      - IP_RANGE
      - KUBERNETES_CLUSTER
      - KUBERNETES_CRON_JOB
      - KUBERNETES_INGRESS
      - KUBERNETES_INGRESS_CONTROLLER
      - KUBERNETES_JOB
      - KUBERNETES_NETWORK_POLICY
      - KUBERNETES_NODE
      - KUBERNETES_PERSISTENT_VOLUME
      - KUBERNETES_PERSISTENT_VOLUME_CLAIM
      - KUBERNETES_POD_SECURITY_POLICY
      - KUBERNETES_SERVICE
      - KUBERNETES_STORAGE_CLASS
      - KUBERNETES_VOLUME
      - LOAD_BALANCER
      - MANAGED_CERTIFICATE
      - MANAGEMENT_SERVICE
      - NETWORK_ADDRESS
      - NETWORK_INTERFACE
      - NETWORK_ROUTING_RULE
      - NETWORK_SECURITY_RULE
      - PEERING
      - POD
      - PORT_RANGE
      - PRIVATE_ENDPOINT
      - PROXY
      - PROXY_RULE
      - RAW_ACCESS_POLICY
      - REGISTERED_DOMAIN
      - REPLICA_SET
      - RESOURCE_GROUP
      - SEARCH_INDEX
      - SECRET
      - SECRET_CONTAINER
      - SERVERLESS
      - SERVERLESS_PACKAGE
      - SERVICE_ACCOUNT
      - STORAGE_ACCOUNT
      - SUBNET
      - SUBSCRIPTION
      - SWITCH
      - USER_ACCOUNT
      - VIRTUAL_DESKTOP
      - VIRTUAL_MACHINE
      - VIRTUAL_MACHINE_IMAGE
      - VIRTUAL_NETWORK
      - VOLUME
      - WEB_SERVICE
      - DATA_WORKFLOW
      auto: PREDEFINED
    - description: Filter by Wiz project IDs (comma-separated).
      name: project_ids
      required: false
    - description: Filter by cloud-native resource types (comma-separated, e.g. aws_ec2_instance).
      name: native_types
      required: false
    - description: Filter resources updated before this date (ISO 8601, e.g. 2024-01-01T00:00:00Z).
      name: updated_at_before
      required: false
    - description: Filter resources updated after this date (ISO 8601, e.g. 2024-01-01T00:00:00Z).
      name: updated_at_after
      required: false
  - name: wiz-reject-issue
    description: Reject a Wiz Issue.
    arguments:
    - name: issue_id
      required: true
      description: issue id.
    - name: reject_reason
      description: rejection reason.
      required: true
      auto: PREDEFINED
      predefined:
      - FALSE_POSITIVE
      - EXCEPTION
      - WONT_FIX
    - name: reject_note
      description: rejection note.
      required: true
  - name: wiz-reopen-issue
    description: Reopen a Wiz Issue.
    arguments:
    - name: issue_id
      description: issue id.
      required: true
    - name: reopen_note
      description: reopen note.
  - name: wiz-get-issue
    description: Get the details of a Wiz Issue Id.
    arguments:
    - name: issue_id
      description: issue id.
      required: true
  - name: wiz-resolve-issue
    description: Resolve a Wiz Threat Detection Issue. For non-Threat-Detection issues (Toxic Combination, Cloud Configuration, Attack Surface) use wiz-reject-issue — those types are auto-resolved by Wiz when the underlying problem is fixed and cannot be manually resolved.
    arguments:
    - name: issue_id
      required: true
      description: issue id.
    - name: resolution_reason
      description: resolution reason.
      required: true
      auto: PREDEFINED
      predefined:
      - OBJECT_DELETED
      - ISSUE_FIXED
      - FALSE_POSITIVE
      - EXCEPTION
      - WONT_FIX
    - name: resolution_note
      description: resolution note.
      required: true
  - name: wiz-issue-in-progress
    description: Set a Wiz Issue to in progress.
    arguments:
    - name: issue_id
      description: issue id.
      required: true
  - name: wiz-set-issue-note
    description: Set a note on a Wiz Issue.
    arguments:
    - name: issue_id
      description: issue id.
      required: true
    - name: note
      description: note.
      required: true
  - name: wiz-clear-issue-note
    description: Clear a note from a Wiz Issue.
    arguments:
    - name: issue_id
      description: issue id.
      required: true
  - name: wiz-set-issue-due-date
    description: Set a due date on a Wiz Issue.
    arguments:
    - name: issue_id
      description: issue id.
      required: true
    - name: due_at
      description: due at date. Format needs to be YYYY-MM-DD.
  - name: wiz-clear-issue-due-date
    description: Clear a due date on a Wiz Issue.
    arguments:
    - name: issue_id
      description: issue id.
      required: true
  - name: wiz-get-issue-evidence
    description: Get the Wiz Issue evidence.
    arguments:
    - name: issue_id
      description: issue id.
      required: true
  - name: wiz-get-project-team
    description: Get the Project Owners and Security Champions details.
    arguments:
    - name: project_name
      description: project name.
      required: true
  - name: wiz-rescan-machine-disk
    description: DEPRECATED.
    deprecated: true
    arguments:
    - name: vm_id
      description: vm cloud provider id.
      required: true
  - name: wiz-copy-to-forensics-account
    description: Copy VM's Volumes to a Forensics Account.
    arguments:
    - name: resource_id
      description: ID of the resource to copy its Volumes. Can be Wiz ID or provider's ID.
      required: true
  - name: get-remote-data
    description: Get remote data for a single incident. Called by the mirroring engine, not for manual use.
    arguments:
    - name: id
      description: The remote incident ID.
    - name: lastUpdate
      description: The UTC timestamp of the last update.
    outputs: []
  - name: get-modified-remote-data
    description: Get the list of incidents modified since the last update. Called by the mirroring engine, not for manual use.
    arguments:
    - name: lastUpdate
      description: The UTC timestamp of the last update.
    outputs: []
  - name: update-remote-system
    description: Push local changes to Wiz. Called by the mirroring engine, not for manual use.
    arguments:
    - name: data
      description: The incident data.
    - name: entries
      description: New entries to push.
    - name: incidentChanged
      description: Whether the incident changed.
    - name: remoteId
      description: The remote incident ID.
    outputs: []
  - name: get-mapping-fields
    description: Returns the list of fields for an incident type. Called by the mirroring engine, not for manual use.
    arguments: []
    outputs: []
  dockerimage: demisto/python3:3.12.13.10116658
  isfetch: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
  ismappable: true
  isremotesyncin: true
  isremotesyncout: true
tests:
- No tests
fromversion: 6.0.0
defaultmapperout: Wiz - Outgoing Mapper