Wiz

📘Note

Connecting this data type requires the involvement of Hunters Support.

Overview

Table name: wiz_events

Wiz event logs are an integral part of the platform, capturing detailed information about security events, configuration changes, and user activities within cloud environments. These logs offer valuable insights into potential security risks, misconfigurations, and compliance violations, enabling organizations to proactively identify and remediate issues to enhance their overall security posture.

Send data to Hunters

Hunters supports the collection of logs from Wiz using webhook. The webhook is created by Hunters. Once Hunters has created the webhook, we will share the following details:

• URL

• Bearer Authorization Key

To connect Wiz Events:

1. Contact Hunters support to retrieve the URL and Bearer Authorization Key.

2. Once you receive this information, log into your Wiz account and navigate to New Automation Action.

3. Supply the relevant details:

   • Action - Call a webhook

   • Authentication - Token

   • Token (Supplied by Hunters). Example: ab830751cbdf4fe9a20f3b46af0ebb40c91099b121e842fe8438c6d01d80fe0b

   • URL (Supplied by Hunters). Example: <https://sampledomain.execute-api.us-west-2.amazonaws.com/webhook/v1/e96b2531-de2c-442a-9d85-912165eff354>
     

     

4. Configure a rule in Wiz to send the Issues to the Webhook (specifically, Created, Opened, Closed, Reopened).

5. Complete the process on the Hunters platform, following this guide.

Expected format

The logs are expected to be in JSON format.

{"trigger": {"source": "ISSUE", "type": "Created", "ruleId": "dddddddd-1260-1260-1260-dddddddd", "ruleName": "hunters-rule", "updatedFields": " status field was changed from <nil> to OPEN,  severity field was changed from <nil> to HIGH, ", "changedBy": "Wiz"}, "issue": {"id": "aaaaaaaaa-6767-6767-6767-aaaaaaaaa", "status": "OPEN", "severity": "HIGH", "created": "2022-08-03T05:34:44.000000Z", "projects": "AWS Prod related accounts, all aws accts, "}, "resource": {"id": "arn:aws:ec2:us-east-1:88888888:instance/i-88888888", "name": "Builder", "type": "virtualMachine", "cloudPlatform": "AWS", "subscriptionId": "888888888", "subscriptionName": "888888888 AWS 888888888", "region": "us-east-1", "status": "Active", "cloudProviderURL": "https://us-east-1.console.aws.amazon.com/ec2/v2/home?region=us-east-1#InstanceDetails:instanceId=i-888888888"}, "control": {"id": "wc-id-888888888", "name": "Critical/High severity network vulnerability with a known exploit was detected on a publicly exposed VM instance", "description": "This VM has Critical/High severity vulnerabilities with known and public exploits and is remotely exploitable. Furthermore, this VM is also widely exposed to the internet. This might allow an attacker to compromise the affected instance in your environment remotely exfiltrating data or disrupting workflows. All these factors make this a Critical severity Issue.", "severity": "HIGH"}}

📘Note

Connecting this data type requires the involvement of Hunters Support.

Overview

Table name: wiz_threats

Wiz Threats is the native threat detection and alerting capability inside the Wiz Security Graph platform. It consolidates suspicious activity, misconfigurations, and threat intelligence into actionable findings. Wiz Threats surface security-relevant signals across cloud resources, SaaS platforms, and identities, and presents them in a standardized alert format that enables security teams to triage, investigate, and remediate effectively.

Send data to Hunters

Hunters supports the collection of logs from Wiz using webhook. The webhook is created by Hunters. Once Hunters has created the webhook, we will share the following details:

• URL

• Bearer Authorization Key

To connect Wiz Threats:

1. Contact Hunters support to retrieve the URL and Bearer Authorization Key.

2. Once you receive this information, log into your Wiz account and navigate to New Automation Action.

3. Supply the relevant details:

   • Action - Call a webhook

   • Authentication - Token

   • Token (Supplied by Hunters). Example: ab830751cbdf4fe9a20f3b46af0ebb40c91099b121e842fe8438c6d01d80fe0b

   • URL (Supplied by Hunters). Example: <https://sampledomain.execute-api.us-west-2.amazonaws.com/webhook/v1/e96b2531-de2c-442a-9d85-912165eff354>
     

     

4. Configure a rule in Wiz to send the Issues to the Webhook (specifically, Created, Opened, Closed, Reopened).

5. Complete the process on the Hunters platform, following this guide.

Expected format

The logs are expected to be in json format.

{"trigger": {"source": "THREATS", "type": "Created", "ruleId": "", "ruleName": "Manual", "updatedFields": "", "changedBy": ""}, "threat": {"id": "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee", "title": "Test rule name", "description": "Test description", "status": "OPEN", "severity": "LOW", "created": "2023-03-15T12:08:09.708375Z", "resolutionNote": "", "projects": "Acme Prod App, ACME_Labs, ", "threatURL": "https://app.example.com/threats#~(issue~'aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee)", "resolvedAt": "", "updatedAt": "2023-05-02T12:36:13.417495Z", "cloudPlatform": "AWS", "cloudAccounts": [{"cloudPlatform": "AWS", "externalId": "111111111111", "id": "ffffffff-gggg-hhhh-iiii-jjjjjjjjjjjj"}], "cloudOrganizations": [{"cloudPlatform": "AWS", "externalId": "222222222222", "id": "kkkkkkkk-llll-mmmm-nnnn-oooooooooooo"}], "actors": [{"externalId": "test-actor", "id": "pppppppp-qqqq-rrrr-ssss-tttttttttttt", "name": "test-actor", "nativeType": "Microsoft Entra ID Application Service Principal", "type": "SERVICE_ACCOUNT"}], "resources": [{"externalId": "test-resource", "id": "uuuuuuuu-vvvv-wwww-xxxx-yyyyyyyyyyyy", "name": "test-resource", "nativeType": "Microsoft Entra ID Application Service Principal", "type": "SERVICE_ACCOUNT"}], "tdrNames": "Test rule name, ", "detectionIds": "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee, ", "mitreTechniques": ["T1070.006"], "mitreTactics": ["TA0005"], "notes": "user1@example.com-Here is another test note, user2@example.com-This is a test note, "}}
{"trigger": {"source": "ISSUE", "type": "Created", "ruleId": "bbbbbbbb-cccc-dddd-eeee-ffffffffffff", "ruleName": "Hunters Issues", "updatedFields": " threatDetectionDetails.actors field was changed from null to [{\"id\":\"gggggggg-hhhh-iiii-jjjj-kkkkkkkkkkkk\"}],  cloudAccounts field was changed from null to [{\"cloudProvider\":\"\",\"externalId\":\"\",\"id\":\"llllllll-mmmm-nnnn-oooo-pppppppppppp\",\"issues\":null}],  severity field was changed from null to HIGH,  threatDetectionDetails.detections field was changed from null to {\"nodes\":[{\"id\":\"qqqqqqqq-rrrr-ssss-tttt-uuuuuuuuuuuu\"}],\"pageInfo\":null,\"totalCount\":1},  status field was changed from null to OPEN,  threatDetectionDetails.resources field was changed from null to [{\"id\":\"vvvvvvvv-wwww-xxxx-yyyy-zzzzzzzzzzzz\"}], ", "changedBy": "Wiz"}, "issue": {"id": "aaaaaaaa-1111-2222-3333-444444444444", "status": "OPEN", "severity": "HIGH", "created": "2025-12-22T06:30:05.27885Z", "projects": ""}, "resource": {"id": "5555555555555555555555555555555555555555555555555555555555555555555555", "name": "test-resource-name-0", "type": "Container", "cloudPlatform": "Kubernetes", "subscriptionId": "k8s/subscription/6666666666666666666666666666666666666666666666666666666666666666666666/cluster", "subscriptionName": "test-subscription", "region": "", "status": "", "cloudProviderURL": ""}, "control": {"id": "test-control-id-123", "name": "Anomalous Kubectl command execution inside a container", "description": "Kubectl CLI was executed on this container image with a command that wasn't seen on it in the last 30 days. This could indicate a threat actor attempting to escalate privileges or laterally move within the cluster.", "severity": "HIGH", "risks": []}}

Overview

Table name: wiz_graph_control_logs

Wiz Graph Control Logs - are the native posture evaluation and compliance monitoring capability inside the Wiz Security Graph platform. They consolidate configuration checks, vulnerability assessments, and policy evaluations into actionable pass-or-fail records. Wiz Graph Control Logs surface architectural weaknesses and compliance gaps across cloud resources, workloads, and identities, and present them in a standardised log format that enables security teams to track security posture, prioritise risk, and harden their environments effectively.

Send data to Hunters

Hunters supports the collection of logs from Wiz using webhook. The webhook is created by Hunters. Once Hunters has created the webhook, we will share the following details:

• URL

• Bearer Authorization Key

To connect Wiz System Health Logs:

1. Contact Hunters support to retrieve the URL and Bearer Authorization Key.

2. Once you receive this information, log into your Wiz account and navigate to New Automation Action.

3. Supply the relevant details:

   • Action - Call a webhook

   • Authentication - Token

   • Token (Supplied by Hunters). Example: ab830751cbdf4fe9a20f3b46af0ebb40c91099b121e842fe8438c6d01d80fe0b

   • URL (Supplied by Hunters). Example: <https://sampledomain.execute-api.us-west-2.amazonaws.com/webhook/v1/e96b2531-de2c-442a-9d85-912165eff354>
     

     

4. Configure a rule in Wiz to send the Issues to the Webhook (specifically, Created, Opened, Closed, Reopened).

5. Complete the process on the Hunter platform, following this guide.

Expected format

The logs are expected to be in json format.

{"control":{"id":"wc-id-0001","name":"Publicly exposed VM with end-of-life software","description":"This VM is exposed to the public internet, and running software in a version that the vendor no longer supports. \n\nPublicly exposed resources are more easily accessible for an attacker than internal ones. Moreover, end-of-life software will usually not be patched for any vulnerabilities affecting them, as they are no longer supported. Therefore, an attacker that manages to execute code on the  VM can exploit unpatched vulnerabilities, or use a network vulnerability on the VM for initial access to your environment. ","type":"SECURITY_GRAPH","severity":"MEDIUM","enabled":"true","resolutionRecommendation":"Limit external exposure\n* Restrict access to resources that do not need to be accessible from the internet.\n* Ensure that exposed ports allow only encrypted communications.\n\nAvoid end-of-life technologies\n* Update all software running in your environment to the latest version.\n   * For public images, ensure that you update to the latest version.\n   * For private images, check the Finding for detailed information regarding the vulnerability.\n   * Build a new image with the fixed vulnerability and replace it in the resource.\n* If you cannot use the latest version, prioritize patching resources in your environment according to the attack surface they are exposed to and the potential impact of this resource’s compromise (based on the Issue severity).","createdBy":"","createdAt":"2020-01-01T00:00:00.000000Z","lastRunAt":"2020-01-02T01:02:03.123456Z","lastSuccessfulRunAt":"2020-01-02T01:02:03.123456Z","serviceTickets":""},"lastRunUpdate":{"createdIssues":"0","reopenedIssues":"0","ignoredIssues":"0","resolvedIssues":"1"}}
{"control":{"id":"wc-id-0002","name":"VM with kernel vulnerabilities is running a container","description":"This VM is a container host and has kernel vulnerabilities.\n\nA container and its host share the host's kernel, meaning that the kernel vulnerability on the host could potentially be exploited from the container. Therefore, an attacker with access to the container can exploit kernel vulnerabilities to escape to the host and execute code on the VM.","type":"SECURITY_GRAPH","severity":"INFORMATIONAL","enabled":"true","resolutionRecommendation":"Prevent container escape \n* Patch kernel vulnerabilities on the host. \n   * For public images, ensure that you update to the latest version.\n   * For private images, check the Finding for detailed information regarding the vulnerability.\n   * Build a new image with the fixed vulnerability and replace it in the resource.\n* Use Pod Security Standards (Baseline or Restricted)\n* Avoid allowing capabilities assignment to containers beyond the default capabilities assigned.\n* Avoid running privileged containers.\n* Avoid sharing namespaces from the host to the container.\n* Assign a network policy to namespaces so proper network segmentation is in place in case of a compromised container.","createdBy":"","createdAt":"2020-01-01T00:00:00.000000Z","lastRunAt":"2020-01-03T04:05:06.654321Z","lastSuccessfulRunAt":"2020-01-03T04:05:06.654321Z","serviceTickets":""},"lastRunUpdate":{"createdIssues":"0","reopenedIssues":"0","ignoredIssues":"0","resolvedIssues":"3"}}

Overview

Table name: wiz_admission_review_logs

Wiz Admission Review Logs capture the complete lifecycle of admission decisions made by the Wiz platform during resource access and policy evaluation. These logs provide detailed visibility into why a request was allowed, denied, or flagged by recording the policies that were evaluated, the conditions that matched, the identities involved, and the final enforcement outcome. Admission Review Logs are particularly valuable for troubleshooting policy violations, validating security controls, and auditing changes across Kubernetes environments. Security and platform teams use these logs to investigate deployment failures, identify misconfigurations, verify policy compliance, and demonstrate adherence to security and regulatory requirements. By maintaining a detailed audit trail of admission decisions, Wiz helps organizations improve governance, accelerate incident investigations, and ensure that only compliant workloads are deployed into their Kubernetes clusters.

Send data to Hunters

Hunters supports the collection of logs from Wiz using webhook. The webhook is created by Hunters. Once Hunters has created the webhook, we will share the following details:

• URL

• Bearer Authorization Key

To connect Wiz Admission Review Logs:

1. Contact Hunters support to retrieve the URL and Bearer Authorization Key.

2. Once you receive this information, log into your Wiz account and navigate to New Automation Action.

3. Supply the relevant details:

   • Action - Call a webhook

   • Authentication - Token

   • Token (Supplied by Hunters). Example: ab830751cbdf4fe9a20f3b46af0ebb40c91099b121e842fe8438c6d01d80fe0b

   • URL (Supplied by Hunters). Example: <https://sampledomain.execute-api.us-west-2.amazonaws.com/webhook/v1/e96b2531-de2c-442a-9d85-912165eff354>
     

     

4. Configure a rule in Wiz to send the Issues to the Webhook (specifically, Created, Opened, Closed, Reopened).

5. Complete the process on the Hunters platform, following this guide.

Expected format

The logs are expected to be in json format.

{"trigger":{"source":"","type":"Created","ruleId":"0000000000000000","ruleName":"Send Failed Admission Reviews To Hunters Events"},"event":{"name":"MisconfigurationsAdmissionReview","eventURL":"https://example.com/events/0000000000000000","cloudPlatform":"Kubernetes","timestamp":"2020-01-01T00:00:00.123456789Z","source":"WizMisconfigurationsAdmissionValidation","category":"Modify"},"subjectResource":{"name":"example-pod-0001","type":"Pod","providerUniqueId":"","externalId":"k8s/pod/example-pod-0001"},"ExtraDetails":{"Total Matches":"7","Critical Matches":"0","High Matches":"0"}}

Overview

Table name: wiz_cloud_events

Wiz Cloud Events is the native real-time activity monitoring and audit log analysis capability inside the Wiz Security Graph platform. It consolidates continuous streams of API calls, access logs, and configuration changes from cloud providers and Kubernetes environments into actionable behavioral insights. Wiz Cloud Events surface suspicious administrative actions and operational anomalies across cloud infrastructure, and presents them in a standardized event format that enables security teams to trace user activity, investigate incidents, and respond to active threats effectively.

Send data to Hunters

Hunters supports the collection of logs from Wiz using webhook. The webhook is created by Hunters. Once Hunters has created the webhook, we will share the following details:

• URL

• Bearer Authorization Key

To connect Wiz System Health Logs:

1. Contact Hunters support to retrieve the URL and Bearer Authorization Key.

2. Once you receive this information, log into your Wiz account and navigate to New Automation Action.

3. Supply the relevant details:

   • Action - Call a webhook

   • Authentication - Token

   • Token (Supplied by Hunters). Example: ab830751cbdf4fe9a20f3b46af0ebb40c91099b121e842fe8438c6d01d80fe0b

   • URL (Supplied by Hunters). Example: <https://sampledomain.execute-api.us-west-2.amazonaws.com/webhook/v1/e96b2531-de2c-442a-9d85-912165eff354>
     

     

4. Configure a rule in Wiz to send the Issues to the Webhook (specifically, Created, Opened, Closed, Reopened).

5. Complete the process on the Hunter platform, following this guide.

Expected format

The logs are expected to be in json format.

{"trigger":{"source":"CLOUD_EVENTS","type":"Created","ruleId":"00000000-0000-0000-0000-000000000001","ruleName":"Send Medium Cloud Events To Hunters"},"event":{"name":"UpdatePod","eventURL":"https://app.example.com/cloud-events#event/00000000-0000-0000-0000-00000000000a","cloudPlatform":"Kubernetes","timestamp":"2020-01-01T00:00:00.000000Z","source":"WizAdmissionValidation","category":"Modify","actor":{"name":"system:serviceaccount:namespace-one:runner-account","type":"SERVICE_ACCOUNT","IP":"","actingAs":{"name":"","providerUniqueId":"","type":""}},"subjectResource":{"name":"pod-name-aaaaa","type":"Pod","providerUniqueId":"","externalId":"k8s/pod/0001/namespace-one/pod-name-aaaaa","region":"","kubernetesCluster":"cluster-one","kubernetesNamespace":"namespace-one","account_name":"","account_external_id":"000000000001","account_provider":""},"matchedRules":" ruleId: rule-id-1; ruleName: Privileged pod was created by a service account  ruleId: rule-id-2; ruleName: API request with suspicious request header was performed "}}
{"trigger":{"source":"CLOUD_EVENTS","type":"Created","ruleId":"00000000-0000-0000-0000-000000000002","ruleName":"Send Medium Cloud Events To Hunters"},"event":{"name":"UpdatePod","eventURL":"https://app.example.com/cloud-events#event/00000000-0000-0000-0000-00000000000b","cloudPlatform":"Kubernetes","timestamp":"2020-01-02T01:02:03.123456Z","source":"WizAdmissionValidation","category":"Modify","actor":{"name":"system:serviceaccount:namespace-two:runner-account","type":"SERVICE_ACCOUNT","IP":"","actingAs":{"name":"","providerUniqueId":"","type":""}},"subjectResource":{"name":"pod-name-bbbbb","type":"Pod","providerUniqueId":"","externalId":"k8s/pod/0002/namespace-two/pod-name-bbbbb","region":"","kubernetesCluster":"cluster-one","kubernetesNamespace":"namespace-two","account_name":"","account_external_id":"000000000002","account_provider":""},"matchedRules":" ruleId: rule-id-1; ruleName: Privileged pod was created by a service account  ruleId: rule-id-2; ruleName: API request with suspicious request header was performed "}}

Overview

Table name: wiz_detection_logs

Wiz Detection Logs are structured security findings produced by Wiz Defend as part of Wiz’s Threat Detection and Response (TDR) capability. When a Threat Detection Rule (TDR) matches suspicious activity across cloud, identity, or workload signals, Wiz creates a detection that captures what was observed—rule and severity, affected actors and resources, MITRE ATT&CK tactics and techniques, time window, and related evidence events (including source IP and enrichment where available).

Send data to Hunters

Hunters supports the collection of logs from Wiz using webhook. The webhook is created by Hunters. Once Hunters has created the webhook, we will share the following details:

• URL

• Bearer Authorization Key

To connect Wiz Detection Logs:

1. Contact Hunters support to retrieve the URL and Bearer Authorization Key.

2. Once you receive this information, log into your Wiz account and navigate to New Automation Action.

3. Supply the relevant details:

   • Action - Call a webhook

   • Authentication - Token

   • Token (Supplied by Hunters). Example: ab830751cbdf4fe9a20f3b46af0ebb40c91099b121e842fe8438c6d01d80fe0b

   • URL (Supplied by Hunters). Example: <https://sampledomain.execute-api.us-west-2.amazonaws.com/webhook/v1/e96b2531-de2c-442a-9d85-912165eff354>
     

     

4. Configure a rule in Wiz to send the Issues to the Webhook (specifically, Created, Opened, Closed, Reopened).

5. Complete the process on the Hunter platform, following this guide.

Expected format

The logs are expected to be in JSON format.

{ "trigger": { "source": "DETECTIONS", "type": "Created", "ruleId": "123456-456123-758496-123456", "ruleName": "Send Detections to Hunters" }, "id": "123456-456123-758496-123456", "threatId": "123456-456123-758496-123456", "threatURL": "https://app.example.com/issues#~(issue~'123456-456123-758496-123456)", "title": "API Call From Unusual Country", "description": "Login from unusual country Norway using Okta Verify by Jane Doe", "severity": "MEDIUM", "createdAt": "2026-05-28T12:58:35.874119182Z", "tdrId": "cer-okta-identity-loginFromUnusualCountry", "tdrSource": "WIZ", "mitreTactics": [ "TA0001", "TA0001" ], "mitreTechniques": [ "TA0001-T1078", "TA0001-T1078" ], "cloudAccounts": [], "cloudOrganizations": [ { "cloudPlatform": "Okta", "externalId": "example-corp.okta.com", "id": "123456-456123-758496-123456", "name": "example-corp" } ], "timeframe": { "start": "2026-05-28T12:50:56.588Z", "end": "2026-05-28T12:50:56.588Z" }, "actors": [ { "externalId": "0oa1a2b3c4d5e6f7g8h9", "id": "123456-456123-758496-123456", "name": "Jane Doe", "type": "USER_ACCOUNT" } ], "primaryActor": { "email": "jane.doe@example.com", "externalId": "0oa1a2b3c4d5e6f7g8h9", "id": "123456-456123-758496-123456", "name": "Jane Doe", "providerUniqueId": "0oa1a2b3c4d5e6f7g8h9", "type": "USER_ACCOUNT" }, "resources": [ { "externalId": "0oa1a2b3c4d5e6f7g8h9", "id": "123456-456123-758496-123456", "name": "PerimeterX", "nativeType": "Application", "providerUniqueId": "0oa1a2b3c4d5e6f7g8h9", "type": "APPLICATION" } ], "primaryResource": { "externalId": "0oa1a2b3c4d5e6f7g8h9", "id": "123456-456123-758496-123456", "name": "Jane Doe", "type": "USER_ACCOUNT" }, "triggeringEventsCount": 1, "triggeringEvents": [ { "actor": { "externalId": "0oa1a2b3c4d5e6f7g8h9", "id": "123456-456123-758496-123456", "name": "Jane Doe", "providerUniqueId": "0oa1a2b3c4d5e6f7g8h9", "type": "USER_ACCOUNT" }, "actorIP": "198.51.100.45", "actorIPMeta": { "autonomousSystemNumber": 205016, "autonomousSystemOrganization": "Example ISP", "country": "Norway", "customIPRanges": [], "isForeign": true, "relatedAttackGroupNames": [], "reputation": "Benign", "reputationSource": "Threat Intel Provider" }, "category": "Authenticate", "cloudPlatform": "Okta", "description": "user.session.start performed on PerimeterX  by Jane Doe ", "eventTime": "2026-05-28T12:50:56.588Z", "externalId": "123456-456123-758496-123456", "id": "123456-456123-758496-123456", "name": "user.session.start", "origin": "OKTA_SYSTEM_LOGS", "resources": [ { "externalId": "0oa1a2b3c4d5e6f7g8h9", "id": "123456-456123-758496-123456", "name": "PerimeterX", "nativeType": "okta#app", "providerUniqueId": "0oa1a2b3c4d5e6f7g8h9", "type": "APPLICATION" } ], "source": "Okta", "status": "Success" } ], "projects": "" }