AnalysisType: rule
RuleID: Wiz.Issue.Alert.Passthrough
Description: This rule enriches and contextualizes security alerts generated by Wiz.
DisplayName: Wiz Issue Alert Passthrough Rule
Runbook: Review the Wiz alert details to determine what malicious behavior was detected, and whether or not it was blocked.
Reference: https://www.wiz.io/product
Enabled: true
Filename: wiz_issue_alert_passthrough.py
Severity: Medium
LogTypes:
- Wiz.IssuesWebhook
DedupPeriodMinutes: 720
Threshold: 1
Tests:
- Name: Open Alert
ExpectedResult: true
Log:
{
"p_event_time": "2025-07-25 13:09:25.306109000",
"p_log_type": "Wiz.IssuesWebhook",
"p_parse_time": "2025-10-24 05:04:47.058502203",
"p_row_id": "eac735a1259bfda5e5fbf9da29a504",
"p_schema_version": 0,
"p_source_id": "26c0c4b6-781c-40fa-9bc4-5bd16f8e5dda",
"p_source_label": "wiz-issue-webhook",
"p_udm": {},
"control": {
"description": "An EC2 instance has an unprotected port that is being probed by a known malicious host. This rule's final severity is assigned dynamically according to the severity assigned by GuardDuty.",
"id": "cer-awsguardduty-recon-ec2-portprobeunprotectedport",
"name": "Recon:EC2/PortProbeUnprotectedPort",
"risks": [],
"severity": "HIGH"
},
"issue": {
"created": "2025-07-25 13:09:25.306109000",
"id": "e3188a71-794c-5ee8-b97c-eb794aa5b752",
"projects": "",
"severity": "HIGH",
"status": "OPEN"
},
"resource": {
"cloudPlatform": "AWS",
"cloudProviderURL": "",
"id": "",
"name": "jenkins-aws",
"region": "us-east-2",
"status": "",
"subscriptionId": "111111111111",
"subscriptionName": "My-Subscription",
"type": "virtualMachine"
},
"trigger": {
"ruleId": "710a481b-3066-439f-9612-3f103afce604",
"ruleName": "issue-updates",
"source": "ISSUE",
"type": "Open"
}
}
- Name: Low-Severity Open Alert
ExpectedResult: true
Log:
{
"p_event_time": "2025-07-25 13:09:25.306109000",
"p_log_type": "Wiz.IssuesWebhook",
"p_parse_time": "2025-10-24 05:04:47.058502203",
"p_row_id": "eac735a1259bfda5e5fbf9da29a504",
"p_schema_version": 0,
"p_source_id": "26c0c4b6-781c-40fa-9bc4-5bd16f8e5dda",
"p_source_label": "wiz-issue-webhook",
"p_udm": {},
"control": {
"description": "An EC2 instance has an unprotected port that is being probed by a known malicious host. This rule's final severity is assigned dynamically according to the severity assigned by GuardDuty.",
"id": "cer-awsguardduty-recon-ec2-portprobeunprotectedport",
"name": "Recon:EC2/PortProbeUnprotectedPort",
"risks": [],
"severity": "HIGH"
},
"issue": {
"created": "2025-07-25 13:09:25.306109000",
"id": "e3188a71-794c-5ee8-b97c-eb794aa5b752",
"projects": "",
"severity": "LOW",
"status": "OPEN"
},
"resource": {
"cloudPlatform": "AWS",
"cloudProviderURL": "",
"id": "",
"name": "jenkins-aws",
"region": "us-east-2",
"status": "",
"subscriptionId": "111111111111",
"subscriptionName": "My-Subscription",
"type": "virtualMachine"
},
"trigger": {
"ruleId": "710a481b-3066-439f-9612-3f103afce604",
"ruleName": "issue-updates",
"source": "ISSUE",
"type": "Open"
}
}
- Name: Resolved Alert
ExpectedResult: false
Log:
{
"p_event_time": "2025-07-25 13:09:25.306109000",
"p_log_type": "Wiz.IssuesWebhook",
"p_parse_time": "2025-10-24 05:04:47.058502203",
"p_row_id": "eac735a1259bfda5e5fbf9da29a504",
"p_schema_version": 0,
"p_source_id": "26c0c4b6-781c-40fa-9bc4-5bd16f8e5dda",
"p_source_label": "wiz-issue-webhook",
"p_udm": {},
"control": {
"description": "An EC2 instance has an unprotected port that is being probed by a known malicious host. This rule's final severity is assigned dynamically according to the severity assigned by GuardDuty.",
"id": "cer-awsguardduty-recon-ec2-portprobeunprotectedport",
"name": "Recon:EC2/PortProbeUnprotectedPort",
"risks": [],
"severity": "HIGH"
},
"issue": {
"created": "2025-07-25 13:09:25.306109000",
"id": "e3188a71-794c-5ee8-b97c-eb794aa5b752",
"projects": "",
"severity": "LOW",
"status": "Resolved"
},
"resource": {
"cloudPlatform": "AWS",
"cloudProviderURL": "",
"id": "",
"name": "jenkins-aws",
"region": "us-east-2",
"status": "",
"subscriptionId": "984186218765",
"subscriptionName": "My-Subscription",
"type": "virtualMachine"
},
"trigger": {
"ruleId": "710a481b-3066-439f-9612-3f103afce604",
"ruleName": "issue-updates",
"source": "ISSUE",
"type": "Resolved"
}
}
# ------ paired body: wiz_issue_alert_passthrough.py ------
def rule(event):
return (
event.deep_get("issue", "status") == "OPEN"
and event.deep_get("issue", "severity") != "INFORMATIONAL"
)
def title(event):
return f"[Wiz Alert]: " f"{event.deep_get('control', 'name', default='ALERT_NAME_NOT_FOUND')}"
def severity(event):
return event.deep_get("issue", "severity")
def dedup(event):
if event.deep_get("issue", "severity") in ("INFO", "LOW"):
# If Wiz's severity is INFO or LOW, dedup on rule ID
dedup_str = event.deep_get("control", "id", default="<NO_ID_FOUND>")
if dedup_str:
return dedup_str
# If higher severity, dedup on the issue ID
return (
event.deep_get("issue", "id", default="<ISSUE_ID_NOT_FOUND>")
+ "_"
+ event.deep_get("issue", "severity", default="<SEVERITY_NOT_FOUND>")
)
def description(event):
return event.deep_get("control", "description", default="<DESCRIPTION_NOT_FOUND>")
def reference(event):
return get_issue_url(event) or "DEFAULT"
def alert_context(event):
return {
"id": event.deep_get("resource", "id") or "<ID_NOT_FOUND>",
"type": event.deep_get("resource", "type") or "<TYPE_NOT_FOUND>",
"name": event.deep_get("resource", "name") or "<NAME_NOT_FOUND>",
}
def get_issue_url(event):
if issue_id := event.deep_get("issue", "id"):
return f"https://app.wiz.io/issues#~(issue~'{issue_id})"
return None # Return None if there's no issue ID