W

Wiz

Correlate Cheqpoint AI agent approval events with Wiz cloud security findings. When an AI agent attempts a high-risk cloud action - modifying IAM policies, spinning up infrastructure, accessing sensitive datastores - Cheqpoint pauses it for human review before it executes, giving Wiz's risk context to your reviewers.

1. Forward Cheqpoint events to Wiz via webhook

text
Settings → Integrations → Wiz → Notification URL → Save

# Wiz supports custom event ingestion via Integration Hub → Custom Webhook.
# Add a Cheqpoint Notification URL pointing to your Wiz webhook endpoint.

# Cheqpoint sends structured JSON for every approval event.
# Wiz can correlate these against cloud findings by resource or account.

2. Include cloud resource context in approval requests

javascript
// When your AI agent requests a cloud action, include
// the resource IDs so reviewers see full context.

const result = await cheq.checkpoint({
  action: "modify_iam_policy",
  summary: "Agent requesting write access to S3 bucket prod-data-lake",
  details: {
    policyArn:    "arn:aws:iam::123456789:policy/DataLakeWrite",
    resourceId:   "arn:aws:s3:::prod-data-lake",
    accountId:    "123456789012",
    requestedBy:  "etl-agent-prod",
    cloudProvider: "AWS",
  },
  riskScore: 0.9,
  tags: ["cloud-infrastructure", "iam"],
});

3. Cheqpoint event enriched with Wiz findings

json
// Wiz Integration Hub can enrich incoming Cheqpoint events
// with findings for the referenced resource.

// Example enriched payload (Wiz adds finding context):
{
  "requestId":   "req_01j3abc",
  "action":      "modify_iam_policy",
  "resourceId":  "arn:aws:s3:::prod-data-lake",
  "riskScore":   0.9,

  // Wiz enrichment:
  "wiz": {
    "resourceRisk": "critical",
    "openFindings": 3,
    "findings": [
      { "id": "wiz-finding-001", "title": "S3 bucket with sensitive data exposed", "severity": "HIGH" }
    ]
  }
}

4. Reviewer sees Wiz risk context

text
// Pass Wiz finding context in the details object.
// Reviewers see it in the Technical View of the approval request.

details: {
  ...agentPayload,
  wizResourceRisk:    "critical",
  wizOpenFindings:    3,
  wizTopFinding:      "S3 bucket with sensitive data exposed - severity HIGH",
  wizResourceLink:    "https://app.wiz.io/resources/...",
}

// Reviewers can click through to the Wiz resource view
// before making an approval decision.

How this works end to end

  1. AI agent attempts a cloud action (IAM change, storage access, infra deploy).
  2. Cheqpoint intercepts it and pauses execution for human review.
  3. Cheqpoint fetches (or receives) Wiz findings for the targeted cloud resource.
  4. Reviewer sees the agent's intent and the Wiz risk score for that resource.
  5. Reviewer approves or rejects with full cloud context. Decision is logged for audit.
  6. Cheqpoint forwards the event to Wiz for cloud risk timeline correlation.