Integrate Wiz Cloud to Autobahn via Webhook

Wiz Cloud is a push (webhook) integration. Rather than Autobahn pulling data from Wiz, you configure Wiz to stream cloud security findings to a webhook URL that Autobahn generates for you. Autobahn ingests those findings, clusters them into Cyber Fitness Workouts for prioritization and remediation, and automatically closes findings that Wiz reports as resolved. This guide walks through generating the webhook URL in Autobahn and configuring Wiz to send findings to it.

At a glance: (1) In Autobahn, enable the Wiz Cloud integration and copy your webhook URL. (2) In Wiz, create a webhook automation that POSTs issues to that URL. (3) New and updated findings appear in your Workouts within a day.

Before you start: get admin access in Wiz and Autobahn

You need an Admin role in Autobahn Security to enable integrations.
You need access in Wiz to create Integrations / Automation Rules (webhook actions).
The Wiz Cloud integration must be enabled for your Autobahn workspace. If you don’t see it on the Integrations page, contact your Autobahn representative.

Navigate to the Wiz Cloud integration page

In Autobahn, open Integrations from the left sidebar.
Locate the Wiz Cloud card and click Configure (or Edit if it was set up before). This opens the Configure an integration page.

Enable the integration and copy your webhook URL

1. Choose the Scan parameter first (before enabling — it locks once the integration is on). This tells Autobahn how to scope the imported Wiz findings:

External (default): treat the findings as internet-facing / external assets.
Internal: treat the findings as internal-network assets. When you pick Internal, a Network selector appears; select the network these assets belong to.
Authenticated
If you are unsure, leave it on External. To change it later you must disable and re-enable the integration, which generates a new webhook URL you will need to re-paste into Wiz.

2. Turn on the Integration enabled toggle (top right). Autobahn generates your unique Autobahn Security App Webhook URL and the Scan parameter becomes read-only.

3. Click the copy icon next to the URL. You will paste this into Wiz in the next section.

Treat the webhook URL as a secret. The token in the URL authorizes submitting findings to your workspace — don’t share it or commit it to source control. If it’s ever exposed, disable and re-enable the integration to rotate it (see below).

Configure the webhook in Wiz

In Wiz, create a webhook integration and an automation rule that sends issues to the Autobahn URL whenever an issue is created, updated, resolved, or rejected. (Exact menu names vary by Wiz version — refer to Wiz’s documentation for Automation Actions / Rules.)

In Wiz, go to Settings → Integrations (Automation) and add a Webhook integration/action.
Set the webhook URL to the Autobahn Security App Webhook URL you copied, method POST, and header Content-Type: application/json.
Create an Automation Rule that triggers on Issue events (created / updated / resolved / rejected) and calls that webhook.
Set the webhook request body to send this JSON, mapping your Wiz issue fields to these keys:

{
  "trigger": {
    "source": "wiz",
    "type": "issue",
    "ruleName": "<your Wiz automation rule name>"
  },
  "issue": {
    "id": "<Wiz issue id>",
    "status": "<OPEN | IN_PROGRESS | RESOLVED | REJECTED>",
    "severity": "<CRITICAL | HIGH | MEDIUM | LOW>",
    "title": "<issue title>",
    "description": "<issue description>"
  },
  "resource": {
    "id": "<cloud resource id>",
    "name": "<resource name>",
    "type": "<resource type>",
    "nativeType": "<native type>",
    "region": "<region>",
    "cloudPlatform": "<AWS | Azure | GCP | ...>",
    "subscriptionId": "<subscription / account id>",
    "subscriptionName": "<subscription name>"
  }
}

Required vs. optional fields. trigger.ruleName, issue.id, and resource.id are required. Everything else is optional but recommended — it enriches the finding (title, severity, affected resource) in Autobahn.

How Wiz statuses are interpreted. OPEN and IN_PROGRESS are treated as active findings; RESOLVED and REJECTED are treated as remediated and are automatically closed in Autobahn. An unrecognized status is ingested as active (never silently dropped).

Enable or disable the integration

Enable: turn the Integration enabled toggle on — this generates (or restores) your webhook URL.
Disable: turn the toggle off and confirm. This permanently deletes your webhook URL; Wiz’s calls to the old URL will no longer be accepted. If you re-enable later, generate a new URL and update it in Wiz.

How Wiz findings appear in Autobahn

Wiz sends an event only when a finding changes, so each import represents that period’s new and updated findings (not a full re-scan).
Autobahn batches incoming events and imports them on a schedule — new or updated vulnerabilities show up in your Workouts within a day.
Findings Wiz reports as RESOLVED / REJECTED are automatically closed in Autobahn; findings that remain open stay active.
Each import appears as a new revision of your Wiz Cloud scan (under Scans), and the findings are clustered into Workouts for remediation.

Tip: To confirm data is flowing, open Scans and look for the Wiz Cloud scan updating with new revisions, then review the prioritized findings under Workouts.

How Can We Help you?