> ## Documentation Index
> Fetch the complete documentation index at: https://docs.incident.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Adding Wiz as an Alert Source

> Send Wiz Issues, Threats and Detections into incident.io as alerts

Wiz can send security findings to incident.io as alerts, so you can page the right people,
route findings to the right team, and run an incident when one matters.

## Step 1: create the alert source

1. Go to [Alerts](https://app.incident.io/~/alerts/sources) in your incident.io dashboard
   and select the **Sources** tab.
2. Press **New alert source**, search for **Wiz**, and continue.
3. Give it a name.

The setup page then shows everything you need for the next step: a **webhook URL**, a
**secret token**, and a **request body** to use. Keep it open.

## Step 2: send events from Wiz

In Wiz, create a webhook integration pointing at the webhook URL from step 1, using token
authentication with the secret token. Then create an automation rule that posts to it,
using the request body shown on the setup page.

Refer to [Wiz's documentation](https://docs.wiz.io) for how to configure webhooks and
automation rules in your tenant.

A few things that affect how your alerts behave in incident.io:

* **Filter the rule.** Everything matching it becomes an alert, so most teams start with a
  severity filter such as Critical or High.
* **Run it on created and resolved events**, so alerts open and close in step with Wiz.
* **Use one rule per object type**, and pair it with the matching request body. incident.io
  shows a separate body for Issues, Threats and Detections, and they are not
  interchangeable.
* **Use the request body as shown.** incident.io reads specific fields from it. Some
  fields include fallbacks that look redundant but are not: without them, an empty value
  from Wiz produces invalid JSON and the event is rejected.

## Step 3: check it works

Send a test event from Wiz. It should appear on the alert source page in incident.io
within a few seconds.

If nothing arrives, check the **Recent requests** section on that page. Rejected payloads
are listed there with a reason, usually a body that isn't valid JSON or one missing an
identifier.

## What each object type means for resolution

| Object         | Resolves automatically                                                                                                                   |
| -------------- | ---------------------------------------------------------------------------------------------------------------------------------------- |
| **Issues**     | Yes, when Wiz sends a resolved event                                                                                                     |
| **Threats**    | Yes, when Wiz sends a resolved event                                                                                                     |
| **Detections** | No. Detections are point-in-time events, so Wiz never resolves one. These alerts stay firing until someone resolves them in incident.io. |

## Resolving Wiz Issues from incident.io

By default, resolving a Wiz alert in incident.io does not change anything in Wiz: Wiz stays
the source of truth, and the alert clears when Wiz resolves the finding.

If you would rather close the Wiz Issue when someone resolves the alert here, connect the
[Wiz integration](/integrations/wiz). That also lets you choose the behaviour separately
for posture issues and for threats.

***

Can't find the alert source you are looking for? Head to our
[integrations page](https://incident.io/integrations) or message us at
[support@incident.io](mailto:support@incident.io).