Before
Analysts likely had to retrieve high-risk findings from Wiz page by page, review each finding, and manually determine whether it represented a virtual-machine malware issue. They then had to create and update Jira tickets, look up endpoint agents, collect artifacts, and coordinate host disconnection through separate security tools.
How it works
- Receive the event, query Wiz for all high- and critical-severity open or in-progress findings, and continue through every result page.
- Identify virtual-machine malware findings, create Jira tickets, verify the related SentinelOne agent, and attach available Linux artifacts.
- Add remediation or ignore choices to Jira; if remediation is selected and the agent is not already disconnected, isolate the host and record the action.
Workflow details
- Intake and pagination: An incoming email event starts the workflow, which queries Wiz for high- and critical-severity findings that are open or in progress. It continues requesting additional pages until all matching results have been received.
- Finding qualification and ticket creation: Each finding is evaluated individually, and the workflow continues with findings identified as both virtual-machine entities and malware-related Wiz issues. A Jira issue is then created to track the finding and its remediation process.
- Endpoint verification and evidence collection: The workflow searches SentinelOne for an agent matching the affected computer name. If an agent is found, it retrieves artifacts from the Linux machine and attaches them to the Jira issue; if no agent is found, it records that outcome in Jira.
- Remediation decision support: When remediation is possible, the workflow adds Jira comments containing options to disconnect the host from the enterprise environment or ignore the issue. Both choices provide a corresponding comment back to Jira.
- Containment and status recording: For the remediation path, the workflow retrieves the agent by its identifier, checks whether it is already disconnected, and disconnects it from the network when appropriate. The resulting action is then recorded in Jira.
What changed
Qualifying Wiz findings are now converted into Jira cases automatically, with endpoint checks, artifact collection, and comments handled in the same workflow. A human decision remains between ignoring the issue and remediating it, while the selected remediation path verifies the agent state before disconnecting the host and documenting the result.
Work removed
Manually paging through Wiz findings, reviewing findings one by one, creating Jira tickets, looking up agents by hostname and UUID, collecting and attaching Linux artifacts, posting Jira comments, and initiating the eligible host disconnection.
Expected outcome
A conservative estimate is that at least four recurring manual actions per qualifying finding—ticket creation, endpoint lookup, artifact handoff, and Jira status communication—are removed, while network disconnection remains governed by the selected remediation path.
