heroui logo

Wiz Integration Updated Or Deleted

Panther Rules

View Source
Summary
The rule 'Wiz Integration Updated Or Deleted' is designed to monitor and detect any updates or deletions made to integrations within the Wiz platform. Integration management is crucial as it involves the handling of third-party services and data, which if altered without proper authorization, could lead to security breaches. This rule specifically tracks actions related to integration modifications, helping to safeguard the integrity of system integrations by alerting on unintended changes. When an integration is either updated or deleted, an audit log is generated with critical details including the action performed, timestamp, source IP, and user information. The expected behavior is a detection of log entries indicating successful deletions or updates, while unauthorized attempts or failures can trigger alerts for further investigation. This proactive monitoring helps organizations ensure that integration changes are well-managed and comply with internal policies, significantly contributing to overall security posture.
Categories
  • Cloud
  • Infrastructure
  • Web
Data Sources
  • WMI
  • User Account
  • Application Log
  • Network Traffic
ATT&CK Techniques
  • T1562.001
Created: 2024-09-16