Integrate Wiz Cloud to Autobahn via Webhook

Wiz Cloud is a push (webhook) integration. Rather than Autobahn pulling data from Wiz, you configure Wiz to stream cloud security findings to a webhook URL that Autobahn generates for you. Autobahn ingests those findings, clusters them into Cyber Fitness Workouts for prioritization and remediation, and automatically closes findings that Wiz reports as resolved. This guide walks through generating the webhook URL in Autobahn and configuring Wiz to send findings to it.

At a glance: (1) In Autobahn, enable the Wiz Cloud integration and copy your webhook URL. (2) In Wiz, create a webhook automation that POSTs issues to that URL. (3) New and updated findings appear in your Workouts within a day.

Before you start: get admin access in Wiz and Autobahn

You need an Admin role in Autobahn Security to enable integrations.
You need access in Wiz to create Integrations / Automation Rules (webhook actions).
The Wiz Cloud integration must be enabled for your Autobahn workspace. If you don’t see it on the Integrations page, contact your Autobahn representative.

Navigate to the Wiz Cloud integration page

In Autobahn, open Integrations from the left sidebar.
Locate the Wiz Cloud card and click Configure (or Edit if it was set up before). This opens the Configure an integration page.

Enable the integration and copy your webhook URL

1. Choose the Scan parameter first (before enabling — it locks once the integration is on). This tells Autobahn how to scope the imported Wiz findings:

External (default): treat the findings as internet-facing / external assets.
Internal: treat the findings as internal-network assets. When you pick Internal, a Network selector appears; select the network these assets belong to.
If you are unsure, leave it on External. To change it later you must disable and re-enable the integration. Your webhook URL stays the same, so there is nothing to update in Wiz.

2. Turn on the Enable integration toggle. Autobahn generates your unique Autobahn Security App Webhook URL and the Scan parameter becomes read-only.

3. Click the copy icon next to the URL. You will paste this into Wiz in the next section.

Treat the webhook URL as a secret. The token in the URL authorizes submitting findings to your workspace — don’t share it or commit it to source control. If it’s ever exposed, contact your Autobahn representative to have the URL invalidated.

Configure the webhook in Wiz

In Wiz, create a webhook integration and an automation rule that sends issues to the Autobahn URL whenever an issue is created, updated, resolved, or rejected. (Wiz offers both Automation Rules and Process Flows. This guide covers Automation Rules. Exact menu names vary by Wiz version, so refer to Wiz’s documentation for Automation Actions / Rules.)

In Wiz, go to Settings → Integrations → Add Integration, and under SIEM & Automation Tools select Webhook.
Set the webhook URL to the Autobahn Security App Webhook URL you copied, method POST, and header Content-Type: application/json.
Go to Policies → Automation Rules → New Rule and create a rule that triggers on Issue events (created / updated / resolved / rejected) and calls that webhook.
Set the webhook request body to send this JSON, mapping your Wiz issue fields to these keys:

{
  "trigger": {
    "ruleName": "{{ruleName}}"
  },
  "issue": {
    "id": "{{issue.id}}",
    "status": "{{issue.status}}",
    "severity": "{{issue.severity}}",
    "title": "{{issue.title}}",
    "description": "{{issue.control.descriptionPlainText}}"
  },
  "resource": {
    "id": "{{issue.entitySnapshot.providerId}}",
    "name": "{{issue.entitySnapshot.name}}",
    "cloudProviderURL": "{{issue.entitySnapshot.cloudProviderURL}}"
  }
}

How Wiz statuses are interpreted. OPEN and IN_PROGRESS are treated as active findings; RESOLVED and REJECTED are treated as remediated and are automatically closed in Autobahn. An unrecognized status is ingested as active (never silently dropped).

Test your setup. Wiz’s Test Webhook button confirms that Autobahn is reachable, but it does not verify your field mapping. To test end to end, change the status of a real issue in Wiz so the automation rule fires, then allow up to 24 hours and open the Scans page in Autobahn to look for a new revision of your Wiz Cloud scan.

Enable or disable the integration

Enable: turn the Integration enabled toggle on — this generates (or restores) your webhook URL.
Disable: turn the toggle off and confirm. Wiz’s calls to your webhook URL will no longer be accepted. The URL itself is preserved, so if you re-enable later the same URL is restored and nothing needs changing in Wiz.

How Wiz findings appear in Autobahn

Wiz sends an event only when a finding changes, so each import represents that period’s new and updated findings (not a full re-scan).
Autobahn batches incoming events and imports them on a schedule — new or updated vulnerabilities show up in your Workouts within a day.
Findings Wiz reports as RESOLVED / REJECTED are automatically closed in Autobahn; findings that remain open stay active.
Each import appears as a new revision of your Wiz Cloud scan (under Scans), and the findings are clustered into Workouts for remediation.

Tip: To confirm data is flowing, open Scans and look for the Wiz Cloud scan updating with new revisions, then review the prioritized findings under Workouts.

How Can We Help you?