Wiz Cloud Defender Integration Guide (Webhook)

This guide covers the push-based Wiz integration: Wiz sends real-time Issues, Detections, and Threats events directly to Realm via webhook, using the Cloud HTTP input feed. This is a separate integration path from the Wiz API (pull-based) feed covered in the Wiz API Integration Guide — you can configure either or both, depending on your needs.

Overview

Wiz uses Automation Rules to evaluate conditions (e.g., "Critical severity Issue in AWS production") and, when matched, sends a JSON payload to a webhook URL you control. This gives you near real-time delivery instead of waiting on the next scheduled API poll.

There are three event payload types:

Event type	Contains
Issues	Details about the Issue, the Control that generated it, and the affected resource (VM, container, etc.).
Detections	Security event details, affected resources, and related Threats.
Threats	Trigger details, event information, actor details, subject resource, and matched rules.

Each type has its own payload structure — Wiz's reference documentation for each (Issues Webhook, Detections Webhook, Threats Webhook) shows the exact fields and template variables available.

Important: Unlike the API feed, you cannot self-provision a Wiz webhook. Wiz's WIN team must create it on their side. The steps below walk through configuring your end (Realm) first, then submitting the request to Wiz.

Prerequisites

• Ability to create a Cloud HTTP input feed in Realm.
• Access to email or the WIN Community to submit your webhook request to Wiz (win@wiz.io).
• If you've already set up the Wiz API feed, you can reuse those OAuth credentials later in this guide to look up Wiz's source IP addresses for allow-listing.

Step 1: Configure the Cloud HTTP feed in Realm

Before contacting Wiz, set up the receiving side in Realm so you have an endpoint URL and credentials ready to hand off.

Use this transport when your log source can POST JSON payloads over HTTPS to a webhook URL.

Add a Cloud HTTP Input Feed

1. On the Select Transport Method step in the Add Source flow, or from the source page, click Add Input Feed.
2. Select Cloud HTTP and give it a name.
3. Enter a token if you have one or leave it empty to have the system generate a random token for you.
4. Click Save.
5. Click ... > Edit on the newly created input feed.
6. Click on eye icon in the token field to view token value.
7. Copy the Webhook URL and Token — you will need these when configuring your log source.
8. By default, the webhook uses a public CA. You can switch to using a Realm private CA from the new or edit input feed form. After saving the feed, Private CA value will be shown. You can copy and paste it in to the source product.

Step 2: Decide which events and conditions to send

Before submitting your request, decide:

• Which event types you want (Issues, Detections, and/or Threats) — you can request more than one, each typically routed through its own Automation Rule.
• What conditions should trigger a webhook (e.g., severity level, cloud environment, project). Wiz Automation Rules act as "if this, then that" statements — only events matching your criteria will be sent.

Step 3: Submit your webhook request to Wiz's WIN team

Email win@wiz.io (or post in the WIN Community) using the template below, filled in with the details from Step 1:

Subject: <your-company-name>: Request to create a custom webhook

Body:

1. Webhook URL:
   https://intake.yourdomain.com/wiz-cloud-defender   <- your Realm endpoint from Step 1

2. Request Body:
   [Specify the JSON structure/template variables for each event type you want:
    Issues, Detections, and/or Threats. Reference the Wiz Webhook Reference docs
    for the available fields per event type.]

3. Authentication Type:
   Token   <- recommended (most secure); Basic is also supported

4. Client Certificate:
   [State whether you're using a client certificate, and attach/reference it if so.
    If not applicable, note "Not required."]

On-prem note: If your Realm ingestion endpoint is hosted on-prem (yours or your own customer's), flag this explicitly to your WIN contact when submitting the request — webhook delivery will fail without it.

Once Wiz certifies the integration, it becomes available in the Wiz UI as an integration tile, and future webhook setup for other customers can be done directly from there rather than through email.

Step 4: Allow-list Wiz's source IP addresses

Wiz sends webhook traffic from tenant-specific IP addresses, so you should allow-list them at your network edge. Retrieve them using the Wiz GraphQL API (the same OAuth-authenticated API covered in the Wiz API Integration Guide):

query DataCenterInfrastructureDetails {
  dataCenterInfrastructureDetails {
    cloudScannerIps
  }
}

Run this with a valid bearer token against your tenant's API endpoint, and add the returned IPs to your allow-list. Since these IPs are tenant-specific, re-run this query if you onboard additional Wiz tenants.

Verifying incoming requests

Every webhook call from Wiz will include these headers:

Header	Value
content-type	application/json
charset	utf-8
accept-encoding	gzip
user-agent	WizWebhook/1.0
authorization	Bearer <TOKEN_VALUE> (matches the token you configured in Step 1)

Realm validates the authorization header against the token you set in the feed's auth field, and (if configured) validates the TLS client certificate against your tls settings. Requests that don't match either check are rejected.

Troubleshooting

• No events arriving: Confirm with your WIN contact that the Automation Rule(s) are active and that your test conditions (severity/environment) actually match live data.
• 401/403 on incoming requests: Double-check the token in your feed's auth field matches exactly what was provided to the WIN team — tokens are case- and character-sensitive.
• Connection refused / timeouts: Verify Wiz's source IPs are allow-listed (Step 4), and, for on-prem endpoints, confirm your WIN contact was notified during setup.
• TLS handshake failures: If you configured a client certificate in tls, confirm the certificate provided to Wiz is in PEM format and includes both the certificate and private key, and that it matches what's configured in your Realm feed.