Scanner Detection Rules - Wiz

This repository contains Scanner detection rules for Wiz logs.

Examples

Here are a few examples of the detections that are included in this repository:

• IP Restrictions Updated
• SAML Identity Provider Changed
• Service Account Changed

Event Sinks

When these detection rules are triggered, alerts are sent to the event sinks you have configured in Scanner. Depending on the alert's severity level, it will be sent to one of these event sink keys:

• informational_severity_alerts
• low_severity_alerts
• medium_severity_alerts
• high_severity_alerts
• critical_severity_alerts
• fatal_severity_alerts

Deployment

To deploy these rules into your Scanner instance, you can follow the instructions in the Scanner documentation under Detection Rules as Code.