Skip to main content
Wiz can send security findings to incident.io as alerts, so you can page the right people, route findings to the right team, and run an incident when one matters.

​
Step 1: create the alert source

  1. Go to Alerts in your incident.io dashboard and select the Sources tab.
  2. Press New alert source, search for Wiz, and continue.
  3. Give it a name.
The setup page then shows everything you need for the next step: a webhook URL, a secret token, and a request body to use. Keep it open.

​
Step 2: send events from Wiz

In Wiz, create a webhook integration pointing at the webhook URL from step 1, using token authentication with the secret token. Then create an automation rule that posts to it, using the request body shown on the setup page. Refer to Wiz’s documentation for how to configure webhooks and automation rules in your tenant. A few things that affect how your alerts behave in incident.io:
  • Filter the rule. Everything matching it becomes an alert, so most teams start with a severity filter such as Critical or High.
  • Run it on created and resolved events, so alerts open and close in step with Wiz.
  • Use one rule per object type, and pair it with the matching request body. incident.io shows a separate body for Issues, Threats and Detections, and they are not interchangeable.
  • Use the request body as shown. incident.io reads specific fields from it. Some fields include fallbacks that look redundant but are not: without them, an empty value from Wiz produces invalid JSON and the event is rejected.

​
Step 3: check it works

Send a test event from Wiz. It should appear on the alert source page in incident.io within a few seconds. If nothing arrives, check the Recent requests section on that page. Rejected payloads are listed there with a reason, usually a body that isn’t valid JSON or one missing an identifier.

​
What each object type means for resolution

​
Resolving Wiz Issues from incident.io

By default, resolving a Wiz alert in incident.io does not change anything in Wiz: Wiz stays the source of truth, and the alert clears when Wiz resolves the finding. If you would rather close the Wiz Issue when someone resolves the alert here, connect the Wiz integration. That also lets you choose the behaviour separately for posture issues and for threats.
Can’t find the alert source you are looking for? Head to our integrations page or message us at support@incident.io.