Wiz
Telemetry Evidence
These values show how indexed rules identify Wiz telemetry.Elastic
wiz Panther
Wiz.Audit Wiz.Detections Wiz.Issues Wiz.IssuesWebhook wiz
Detection Rules
Elastic #
- Multiple Vulnerabilities by Asset via Wiz source critical: This alert identifies assets with an elevated number of vulnerabilities reported by Wiz, potentially indicating weak security posture, missed patching, or active exposure. The rule highlights assets with a high volume of distinct vulnerabilities, the presence of exploitable vulnerabilities, or a combination of multiple severities, helping prioritize assets that pose increased risk.
Panther #
- Wiz CICD Scan Policy Updated Or Deleted source medium: This rule detects updates and deletions of CICD scan policies.
T1685 - Wiz Connector Updated Or Deleted source medium: This rule detects updates and deletions of connectors.
T1685 - Wiz Data Classifier Updated Or Deleted source medium: This rule detects updates and deletions of data classifiers.
T1685 - Wiz Defend Alert Passthrough Rule source medium: This rule enriches and contextualizes security alerts generated by Wiz.
- Wiz Image Integrity Validator Updated Or Deleted source medium: This rule detects updates and deletions of image integrity validators.
T1685 - Wiz Integration Updated Or Deleted source medium: This rule detects updates and deletions of Wiz integrations.
T1685 - Wiz Revoke User Sessions source medium: This rule detects user sessions revoked.
T1531 - Wiz Rotate Service Account Secret source medium: This rule detects service account secrets rotations.
T1078.004 - Wiz Rule Change source medium: This rule detects creations, updates and deletions of Wiz rules.
T1685 - Wiz SAML Identity Provider Change source high: This rule detects creations, updates and deletions of SAML identity providers.
T1484.002
Show 7 more
- Wiz Service Account Change source high: This rule detects creations, updates and deletions of service accounts.
T1078.004 - Wiz Update IP Restrictions source high: This rule detects updates of IP restrictions.
T1556.009 - Wiz Update Login Settings source medium: This rule detects updates of Wiz login settings.
T1556 - Wiz Update Scanner Settings source medium: This rule detects updates of Wiz scanner settings.
T1685 - Wiz Update Support Contact List source low: This rule detects updates of Wiz support contact list.
T1636.003 - Wiz User Created Or Deleted source low: This rule detects creations and deletions of Wiz users.
T1070.009,T1136.003 - Wiz User Role Updated Or Deleted source medium: This rule detects updates and deletions of Wiz user roles.
T1098.001
Other Index Content
This content is indexed for research but excluded from the detection-rule headline.Panther #