Cloud findings remediation and patching with Wiz
Wiz findings become owned, prioritized tickets. The safe fixes are applied automatically, and the risky ones go to the team that owns the resource.
The problem
A cloud security platform finds thousands of issues. Without an owner, a priority and a fix path, the list only grows. Patch and misconfiguration work stalls between the security team that sees the finding and the team that can change the resource.
Stack
- Cloud security
- Wiz
- Clouds
- AWSMicrosoft AzureGoogle Cloud
- Vulnerability data
- TenableQualysRapid7
- Ticketing and automation
- ServiceNowJiraPythonn8nCortex XSOAR
How it works
- 1
Ingest
Wiz issues and vulnerabilities arrive by API or webhook with the resource, the account, subscription or project, and the exposure context.
- 2
Prioritize
Findings are ranked by exploitability and exposure: internet-facing, reachable from a sensitive resource, known exploited. CVSS and EPSS are inputs, not the only inputs.
- 3
Assign
The owner is resolved from tags, account ownership and the CMDB. A ticket opens in ServiceNow or Jira with the evidence, the fix and the deadline.
- 4
Remediate
For a defined list of safe fixes, such as closing a public storage bucket or removing an open security group rule, the playbook applies the change after a check and, where needed, an approval.
- 5
Patch
For vulnerabilities, it coordinates the patch with the owning team and the maintenance window, then re-scans to confirm.
- 6
Verify and chase
The ticket closes only when Wiz stops reporting the issue. Reminders go out as the deadline approaches.
Guardrails and failure handling
- The catalog of safe fixes is explicit. Each fix is tested and reversible.
- Anything that can affect production waits for the owner's approval.
- Exceptions carry an owner and an expiry date.
- A ticket closes on a clean re-scan, not on a claim that the fix was applied.
What changes for the SOC
- Every finding has an owner and a deadline.
- Safe fixes no longer wait in a ticket queue.
- The backlog is tracked by exposure instead of by count.