Skip to main content
Wiz uses Automation Rules to forward Threat Detections to Wirespeed in real-time via webhook.

​
Prerequisites

  • A Wiz tenant with admin or project-admin permissions
  • Network connectivity from Wiz to https://api.wirespeed.co

​
Setup in Wirespeed

  1. Login to Wirespeed and navigate to Integrations > Add Integration > Wiz
  2. Read this documentation and confirm you have completed the required setup steps
  3. Click Integrate
  4. Select Webhook Details
  5. Copy both the Webhook URL and the Webhook Secret — you’ll need both for the Wiz configuration

​
Setup in Wiz

Deploy the Wirespeed integration first, then create the automation rule that uses it.

​
1. Deploy the Wirespeed Integration

  1. Login to your Wiz tenant
  2. Navigate to Settings > Deployments
  3. Click Add Deployment
  4. Search for Wirespeed and select the Wirespeed integration
  5. Complete the integration form:
    • Name — give it a descriptive name (e.g. “Wirespeed Integration”)
    • Scope — choose All Projects unless you need project-scoped access
    • URL — paste the Webhook URL from Wirespeed
    • Token — paste the Webhook Secret from Wirespeed; Wiz sends it as Authorization: Bearer <token>
  6. Click Add Integration

​
2. Create the Automation Rule

  1. Navigate to Automation > Automation Rules
  2. Click Add Automation Rule
  3. Give the rule a descriptive name (e.g. “Forward threat detections to Wirespeed”)
  4. Configure WHEN the following trigger occurs, based on what your Wiz tenant exposes:
    • If Detection is available, select Detection > IS > Created
    • If Detection is not available (license- or UI-dependent), select another available trigger such as Risk Issue or Cloud Event, then add filters so the rule only fires on Threat Detection findings
  5. Configure IF all of the following match:
    • Wiz requires at least one IF filter on Detection rules. Click Add Filter, select Severity, choose equals one of, and select all severity levels (Critical, High, Medium, Low, Info). Selecting every severity forwards all detections without excluding any by severity.
  6. Under THEN, add the Wirespeed action from the integration you deployed above
  7. Save and enable the Automation Rule
Wiz applies this Automation Rule only to Detections whose Threat Detection Rule is configured to generate Threats. Detections that do not generate Threats are not forwarded.
Wirespeed authenticates incoming webhooks using a Bearer token. If the Token is not configured on the Wirespeed integration, all webhook deliveries will be rejected with 401.

​
What Gets Ingested

Wirespeed receives and processes Threat Detections from Wiz — runtime security events triggered by Wiz Threat Detection Rules. Each detection is automatically normalized to OCSF and enriched with:
  • Severity — Critical, High, Medium, Low, or Informational
  • MITRE ATT&CK — Tactics and techniques mapped from the detection
  • Resources — Affected cloud resources, including cloud account, region, and resource type
  • Triggering Events — The underlying cloud events (e.g. API calls) that fired the detection, including actor IP, IP reputation, and process tree where available
Wirespeed processes Wiz Threat Detections only. Wiz Issues (misconfigurations and vulnerabilities from Controls) are not currently ingested.

​
Troubleshooting

Verify that your Automation Rule is enabled, includes at least one IF filter (for example, Severity equals one of with all levels selected), and is scoped to Threat Detections only — either via a Detection trigger, or via another trigger (e.g. Risk Issue, Cloud Event) with filters limiting it to Threat Detection findings. Confirm the Detection’s Threat Detection Rule is configured to generate Threats. Check the rule’s execution history in Wiz for errors or failed deliveries.
The rule is forwarding Cloud Findings instead of Threat Detections. Delete or disable any automation rule whose trigger is Cloud Finding / vulnerability / misconfiguration, and confirm the active rule is scoped to Threat Detection as described above.
Ensure the Token on the Wirespeed integration matches the Webhook Secret shown in Wirespeed under Webhook Details. Re-copying the secret and re-saving the integration is the fastest fix.
Ensure your Wiz tenant can reach https://api.wirespeed.co on port 443. If you use IP-based firewall rules, allowlist the source IPs returned by the dataCenterInfrastructureDetails GraphQL query above.