Looking for usecases by leveraging WIZ telemetry and Google Secops telemetry

Hi PulakRoy,

When you ingest Wiz Issues and Detections into Google SecOps using the Native data format (WIZ_IO log type), you can correlate cloud posture and runtime alerts from Wiz with enterprise telemetry that lives in SIEM (https://docs.cloud.google.com/chronicle/docs/ingestion/default-parsers/wiz-io). Four practical cross source use cases teams often build are: 1) correlating an identity provider sign in anomaly (such as Okta or Entra ID impossible travel or MFA fatigue) with a subsequent WIZ_IO cloud IAM or privilege escalation detection for the same user email, 2) joining a WIZ_IO exposed workload or critical vulnerability issue with firewall, load balancer, or VPC flow logs and Google Threat Intelligence IOC matches targeting that public IP, 3) enriching a Google SecOps SOAR case with live cloud asset context via the Wiz integration (Get Issue Details) and (List Resource Vulnerability Findings) actions to prioritize containment, and 4) keeping SOC case status, severity, and analyst comments synchronized between Wiz Threats and Google SecOps cases tagged Wiz using the Wiz bidirectional sync job (https://docs.cloud.google.com/chronicle/docs/soar/marketplace-integrations/wiz). Two security considerations when configuring the Wiz SOAR integration and sync job are to grant only the scopes listed in the integration permissions table for the operations you run (such as read:issues, read:posture_issues, read:threat_issues, read:comments, and read:vulnerabilities, plus only the specific write or update scopes your playbooks and sync job require rather than read:all, write:all, and update:all) and to synchronize the Wiz client secret from Google Cloud Secret Manager using the Secret Manager integration credential sync job rather than manually pasting static credentials across plain parameters (https://docs.cloud.google.com/chronicle/docs/soar/marketplace-integrations/secret-manager).

Wiz Blue Agent and the Triage and Investigation Agent in Google SecOps work on different telemetry boundaries and complement each other rather than duplicating the same analysis. Wiz Blue Agent analyzes a cloud threat within Wiz using Wiz cloud graph, posture, and cloud runtime context, and your Google SecOps SOAR playbook can pull that summary straight into a case using the (Get Blue Agent Analysis) action with the Wiz (Threat ID). By contrast, the Triage and Investigation Agent in Google SecOps evaluates SIEM alerts by running dynamic searches, Entity Context Graph lookups, and Google Threat Intelligence enrichment across normalized UDM log sources in your Google SecOps tenant to assess true positive versus false positive indicators (https://docs.cloud.google.com/chronicle/docs/secops/triage-investigation-agent). Keep in mind that automatic investigations cover the log types listed in the agent's default auto investigation table (such as CrowdStrike, Okta, AWS CloudTrail, GCP Cloud Audit, and Office 365, while WIZ_IO is not in that default auto investigation table today), whereas you can also trigger manual investigations from the Alerts and IOCs page.

Thanks, Ben