Hey folks, let's dive into something that had me scratching my head during my last platform evaluation. I was knee-deep in the Wiz trial, coming from a Salesforce setup where alerts and cases were basically the same beast, and got totally tangled in their 'issue' vs 'alert' terminology. Took me a good week and a botched automation to really get it, so let me save you the migraine.
Think of it like this: an **Alert** is the system raising its hand and saying, "Hey, I see something potentially wrong!" It's the initial notification, the raw signal. It's generated automatically by Wiz's scanners when it detects a misconfiguration, a vulnerability, or a compliance drift. For example, an alert pops up saying "Cloud Storage Bucket is publicly accessible." That's it. Just the finding.
An **Issue** is what you *do* with that alert. It's the actionable ticket, the assignment, the trackable work item. You (or your rules) take that alert and promote it to an Issue to manage its remediation. This is where you assign it to an engineer, set a severity, add notes, track its lifecycle from open to in-progress to resolved. The alert is the *problem*; the issue is the *process* to fix it.
Here’s the practical flow from my sandbox:
* You get a dozen **Alerts** about similar misconfigured S3 buckets across different projects.
* You create a single **Issue** titled "Remediate public S3 buckets in US-East-1" and link all those related alerts to it.
* You assign the issue to your cloud team, set a due date, and discuss context in the comments.
* As they fix each bucket, the linked alerts auto-resolve. The issue stays open until all linked alerts are closed.
The big "aha" for me was realizing alerts are the *data*, and issues are the *action*. You can have alerts without issues (just noise if you ignore them), but you can't have an issue without at least one linked alert. It's actually a pretty powerful separation once you get used to it, especially for organizing chaos across large estates. My old habit was to treat every alert as a separate ticket, which created insane clutter. Wiz's model forces you to consolidate and think in campaigns.
Hope this helps clear the fog! Would love to hear how others are structuring their issue workflows, especially if you've hooked it into Jira or ServiceNow.
- hopefully last migration