Wiz Sensor Detections

Wiz Runtime Sensor detections are alerts surfaced by Wiz Defend based on eBPF-based runtime monitoring. These detections cover malware, suspicious processes, lateral movement, and other runtime threats observed across your cloud workloads. RunReveal polls the Wiz GraphQL API every 5 minutes to ingest detection events filtered to WIZ_SENSOR origin.

Ingest Methods

Setup the ingestion of this source using one of the following guides.

• API Polling

API Polling

RunReveal uses Wiz’s GraphQL API with OAuth client credentials to poll the DetectionsTableV2 query for new sensor detections.

Verify It’s Working

Once added, detections should begin flowing within 5 minutes. You can validate that RunReveal is receiving your detections by running the following SQL query in Log Explorer:

SELECT * FROM runreveal.wiz_sensor_detections_logs LIMIT 10

Detection Data

Each detection event includes the following key information:

Detection Details

• Detection ID, type, severity, and description — Core alert metadata
• Created and updated timestamps — When the detection was first seen and last updated
• Remediation status — Whether the detection has been remediated

Resource Context

• Primary resource — The affected resource’s type, name, external ID, and region
• Cloud accounts — Associated cloud account IDs, names, and providers
• Issue correlation — Linked Wiz issue ID for threat grouping

Actor Information

• Primary actor — Name, type, email, access key ID, and decoded principal name

Triggering Events

• Up to 50 triggering events per detection, each containing:
  • Actor IP address and timestamp
  • Command line and runtime program details
  • Raw audit log record with full process tree and eBPF event data

Rule Match

• Rule name, ID, and builtin flag — The detection rule that triggered the alert

Data Collection

• Collection Method: API polling every 5 minutes
• Pagination: Cursor-based, up to 500 results per page
• Event Format: JSON with normalized fields for cross-source querying
• Origin Filter: Only WIZ_SENSOR detections are collected

Schema

The following columns are exposed for this source. RunReveal applies schema normalization across all sources, ensuring uniform field names and data types for cross-source queries and reusable detection logic.