Integrate Wiz with Google SecOps

This document explains how to integrate Wiz with Google Security Operations (Google SecOps).

Integration version: 1.0

Before you begin

To use the integration, you need an API Root, Client ID, and Client Secret.

For more information on how to generate these credentials, see Service Accounts settings.

Integration parameters

The Wiz integration requires the following parameters:

For instructions about how to configure an integration in Google SecOps, see Configure integrations.

You can make changes at a later stage, if needed. After you configure an integration instance, you can use it in playbooks. For more information about how to configure and support multiple instances, see Supporting multiple instances.

Actions

For more information about actions, see Respond to pending actions from Your Workdesk and Perform a manual action.

Ping

Use the Ping action to test the connectivity to Wiz.

This action doesn't run on Google SecOps entities.

Action inputs

None.

Action outputs

The Ping action provides the following outputs:

Output messages

The Ping action can return the following output messages:

Script result

The following table lists the value for the script result output when using the Ping action:

Get Issue Details

Use the Get Issue Details action to obtain information about a specified issue in Wiz.

This action doesn't run on Google SecOps entities.

Action inputs

The Get Issue Details action requires the following parameters:

Action outputs

The Get Issue Details action provides the following outputs:

JSON result

The following example shows the JSON result output received when using the Get Issue Details action:

{
   "id": "f54e3fb9-a520-4e99-aacc-b99f6ae7f28d",
   "createdAt": "2025-07-26T11:47:43.94524Z",
   "updatedAt": "2025-07-31T07:34:54.445702Z",
   "status": "RESOLVED",
   "severity": "CRITICAL",
   "type": "TOXIC_COMBINATION",
   "description": "This container is using an image that contains a file identified as a high/critical severity malware by ReversingLabs.\n\nMalware can imply a malicious actor's presence in your environment. The malware can be used for crypto-mining, data leakage, lateral movement to other resources in your environment, etc.",
   "resolvedAt": "2025-07-31T07:34:54.445702Z",
   "entitySnapshot": {
       "cloudPlatform": "GCP",
       "id": "1971f945-3476-5b3d-a5a1-ab166c3e2eca",
       "name": "cluster-solr",
       "region": "us-central1",
       "subscriptionName": "Wiz-Labs",
       "type": "KUBERNETES_CLUSTER"
   },
   "projects": [
       {
           "id": "904cbc14-1c52-571c-a6b8-46fee263eb0f",
           "name": "GCP Lab"
       }
   ],
   "sourceRules": [
       {
           "id": "wc-id-1038",
           "name": "Container using an image infected with critical/high severity malware",
           "description": "This container is using an image that contains a file identified as a high/critical severity malware by ReversingLabs.\n\nMalware can imply a malicious actor's presence in your environment. The malware can be used for crypto-mining, data leakage, lateral movement to other resources in your environment, etc."
       }
   ]
}

Output messages

The Get Issue Details action can return the following output messages:

Script result

The following table lists the value for the script result output when using the Get Issue Details action:

Reopen Issue

Use the Reopen Issue action to reopen a specified issue in Wiz.

This action doesn't run on Google SecOps entities.

Action inputs

The Reopen Issue action requires the following parameters:

Action outputs

The Reopen Issue action provides the following outputs:

JSON result

The following example shows the JSON result output received when using the Reopen Issue action:

{
    "id": "41facd3f-29b0-4fcf-9a0c-e7fc40416aa0",
    "note": "",
    "status": "OPEN",
    "dueAt": null,
    "resolutionReason": null
}

Output messages

The Reopen Issue action can return the following output messages:

Script result

The following table lists the value for the script result output when using the Reopen Issue action:

Ignore Issue

Use the Ignore Issue action to ignore a specified issue in Wiz.

This action doesn't run on Google SecOps entities.

Action inputs

The Ignore Issue action requires the following parameters:

Action outputs

The Ignore Issue action provides the following outputs:

JSON result

The following example shows the JSON result output received when using the Ignore Issue action:

{
    "id": "41facd3f-29b0-4fcf-9a0c-e7fc40416aa0",
    "note": "",
    "status": "REJECTED",
    "dueAt": null,
    "resolutionReason": "FALSE_POSITIVE"
}

Output messages

The Ignore Issue action can return the following output messages:

Script result

The following table lists the value for the script result output when using the Ignore Issue action:

Resolve Issue

Use the Resolve Issue action to resolve a specified issue in Wiz.

This action doesn't run on Google SecOps entities.

Action inputs

The Resolve Issue action requires the following parameters:

Action outputs

The Resolve Issue action provides the following outputs:

JSON result

The following example shows the JSON result output received when using the Resolve Issue action:

{
    "id": "0db2222f-7d1f-501a-9ad5-fe669c7da036",
    "resolutionNote": "",
    "status": "RESOLVED",
    "dueAt": null,
    "resolutionReason": "NOT_MALICIOUS_THREAT"
}

Output messages

The Resolve Issue action can return the following output messages:

Script result

The following table lists the value for the script result output when using the Resolve Issue action:

Add Comment To Issue

Use the Add Comment To Issue action to add a comment to a specified issue in Wiz.

This action doesn't run on Google SecOps entities.

Action inputs

The Add Comment To Issue action requires the following parameters:

Action outputs

The Add Comment To Issue action provides the following outputs:

JSON result

The following example shows the JSON result output received when using the Add Comment To Issue action:

{
  "createdAt": "2025-08-01T11:59:00.843434941Z", "id":
  "6f997da2-85a0-4be2-b205-83ea19e9b17a", "text": "testing"
}

Output messages

The Add Comment To Issue action can return the following output messages:

Script result

The following table lists the value for the script result output when using the Add Comment To Issue action:

Need more help? Get answers from Community members and Google SecOps professionals.