cyber.hendryadrian.com
Security News · wiz.io

Wiz Launches Automated Forensics for Runtime Sensor Customers

· Original article ↗

Summary

Wiz Forensics is generally available to Runtime Sensor customers, automatically collecting threat-scoped artifacts when detections fire and using AI to analyze evidence for investigation verdicts.

Key points

  • The Wiz Runtime Sensor automatically collects a forensics package when configured Threat Detection Rules trigger, before short-lived workloads disappear.
  • Packages can include the triggering script or binary, process tree, shell histories, SSH configuration, container drift layer, and system logs.
  • Wiz says its Forensics AI Engine analyzes collected artifacts alongside runtime context and supplies evidence-backed insights to its Blue Agent.
  • The article describes an example in which collected artifacts revealed SQL injection consistent with the Soco404 cryptomining campaign and signs of database exfiltration.
  • Another example describes analysis of a suspected reverse shell connecting to openai-gpt-5[.]com:9001, with evidence of database exfiltration and persistence.
  • Wiz Forensics is enabled for all Wiz Runtime Sensor customers, according to the company.

Article Details

Event Type
General availability of Wiz Forensics, an automated forensic evidence collection and AI-assisted threat analysis capability for Wiz Runtime Sensor customers.
Impact
Wiz Runtime Sensor automatically collects threat-scoped forensic artifacts when detections occur, and the Forensics AI Engine and Blue Agent analyze the evidence to help security teams assess alerts and reconstruct attacks. The article illustrates simulated or example scenarios, including suspected SQL injection, cryptomining, data exfiltration, and a reverse shell; it does not report a confirmed real-world incident.

Vendors

WizToday, that changes. Wiz Forensics is now generally available and enabled for Wiz Runtime Sensor customers, giving security teams the evidence they need at the moment it matters most - and the AI analysis to make sense

Products

Forensics AI EngineWiz Forensics changes this with the Forensics AI Engine, which automatically analyzes Sensor forensics packages the moment it’s collected. Scripts, execution data, logs, and runtime event context are all processedWiz Blue Agent1: Wiz's AI Agent analysis provides high-fidelity verdictsWith the Sensor forensics package, the Wiz Blue Agent analyzes the collected artifacts and finds something different: Postgres logs showing evidence of aWiz ForensicsToday, that changes. Wiz Forensics is now generally available and enabled for Wiz Runtime Sensor customers, giving security teams the evidence they need at the moment it matters most - and the AI analysis to make senseWiz Runtime SensorToday, that changes. Wiz Forensics is now generally available and enabled for Wiz Runtime Sensor customers, giving security teams the evidence they need at the moment it matters most - and the AI analysis to make sense

Related Articles