Integration · Security and identity
AI agents for Wiz
Work cloud security issues in Wiz: list open issues by severity or type, read one issue with the affected resource and its notes, move it to in progress, resolve or reject it with a reason, add a note.
- Actions
- 7
- Read
- 4
- Write
- 3
Actions
What your agents can do in Wiz
Work cloud security issues in Wiz: list open issues by severity or type, read one issue with the affected resource and its notes, move it to in progress, resolve or reject it with a reason, add a note, search cloud resources, and list projects. Uses a Wiz service account.
Read 4
Look things up. Nothing changes.
List issues
Lists Wiz issues, highest severity first: open and in-progress ones unless other statuses are given, optionally by severity (CRITICAL, HIGH, MEDIUM, LOW, INFORMATIONAL), type.
Get an issue
Reads one issue by ID with its rule or control (including remediation instructions and the frameworks it maps to), the affected resource, projects.
Search cloud resources
Finds cloud resources Wiz has inventoried by name or ID text (search), type (VIRTUAL_MACHINE, BUCKET, DATABASE, CONTAINER_IMAGE, SERVERLESS …), native cloud type (like ec2#instance), cloud account.
List projects
Lists Wiz projects (the teams, apps or business units issues are grouped by), optionally by name.
Write 3
Create, change or send.
Start or reopen an issue
Moves an issue to IN_PROGRESS (someone is working on it) or back to OPEN.
Resolve or reject an issue
Closes an issue with a reason and a note: REJECTED for a false positive, an accepted exception or won't fix (any issue type); RESOLVED only for Threat Detection issues.
Add a note to an issue
Adds a note (comment) to an issue, shown to everyone working it in Wiz.
A person can approve first
Any write action can be set to wait for a person's approval before it runs, so an agent asks before it changes anything.
Connection
How it connects
Connect it once in the console, then give it to the agents and workflows that need it.
Paste the client ID and secret of an app your organization registered with Wiz. The platform fetches its tokens itself (OAuth client credentials).
Settings
- API endpoint URL
- Wiz environment
Kept safe
- Credentials are stored encrypted with your organization's own keys.
- They are opened only by the process that makes the call, at the moment it runs, and never go into a prompt or the browser.
- Calls go only to the tool's own servers.
Ideas
Ideas to start with
Starting points made only from the actions above. Mix them with any other tool your agents can use.
- 01
Ask about your Wiz data
Ask a question in plain words. The agent can list issues, get an issue or search cloud resources in Wiz, then answers with what it found.
- 02
Let an agent update Wiz
Have the agent start or reopen an issue or resolve or reject an issue in Wiz as part of a larger task. Turn on approval and a person signs off on each change first.
- 03
Share what it finds in Slack
Give one agent Wiz and Slack: it can list issues in Wiz and post a summary to a Slack channel in the same run.
Works well with
More Security and identity tools
- Okta14 actionsFind people and read their groups, apps, MFA factors and sign-in history in Okta, list groups and members, and run joiner and leaver steps.
- Microsoft Entra ID10 actionsFind people and groups in Microsoft Entra ID (formerly Azure Active Directory), read a person's group and role memberships and their sign-in log, add or remove group members, and run leaver and incident steps.
- Google Workspace Admin9 actionsManage people and groups in a Google Workspace domain.
- CrowdStrike Falcon8 actionsInvestigate and respond in CrowdStrike Falcon: search the hosts the Falcon sensor protects and read their details, network-contain a compromised host or lift containment, search and read alerts.
- Vanta8 actionsTrack compliance in Vanta: see which automated tests are failing and the exact resources (users, buckets, laptops, repos) causing it, progress on each framework.
- 1Password4 actionsWatch a 1Password Business account's security activity through the Events API.
FAQ
Wiz and MyDeepAgents
Can MyDeepAgents connect to Wiz?
Yes. The Wiz connector has 7 actions: 4 read and 3 make changes. Your agents can call them as tools, and your workflows can run them as steps.
How do I connect Wiz?
Paste the client ID and secret of an app your organization registered with Wiz. The platform fetches its tokens itself (OAuth client credentials). The connection also asks for: API endpoint URL and Wiz environment. Credentials are stored encrypted with your organization's own keys and are opened only at the moment of a call.
Can an agent change data in Wiz without asking?
Only if you let it. Each of the 3 actions that change data can be set to wait for a person's approval before it runs.
Can I use Wiz in workflows as well as agents?
Yes. Every Wiz action also works as a step in a workflow, and the same connection serves your agents and your workflows.
Early access
Put Wiz to work
Connect it in a few minutes, give an agent the actions it needs, and decide which changes wait for a person.