Wiz Adds Custom Runtime Rules and Automated Blocking Policies
Summary
Wiz introduced custom runtime rules for detecting process, network, DNS, and actor activity in cloud workloads, plus response policies that can simulate or block high-confidence threats.
Key points
- Custom rules are evaluated by the Wiz runtime sensor and can use Boolean operators, string operators, and regular expressions.
- Rules can apply across sensors or be scoped by project, and can be assigned a severity.
- Rule matches can generate issues or findings, feed cloud response playbooks, or trigger runtime response policies.
- Response policies can be triggered by custom-rule matches or broad threat categories, including malware and malicious IOCs.
- Policies can simulate an outcome or block a threat by terminating the process.
Article Details
- Event Type
- Product feature release
- Impact
- Wiz introduced custom runtime rules and runtime response policies, adding configurable detection for process execution, outbound network connections, DNS queries, and network listening, with automated actions that can simulate or block detected activity. The features are intended to improve real-time visibility and threat response in cloud workloads; the article reports no specific security incident or customer impact.