Vulnerability Management Integrations

Vulnerability findings from scanners (Wiz, Tenable, Qualys) provide asset risk context for ManySignal's triage decisions. When an alert targets a system with a critical unpatched CVE, ManySignal elevates the alert severity and flags the vulnerability context in the investigation.

Yes. ManySignal ingests Wiz issue findings via the Wiz API. Critical and High severity Wiz findings are correlated with runtime security events (CloudTrail, identity events) to distinguish exploited vulnerabilities from unpatched but unexploited ones.

Vulnerability management identifies and tracks vulnerabilities in an environment. SOC operations detect when those vulnerabilities are exploited. ManySignal bridges both: vulnerability context informs alert prioritisation, and runtime exploitation evidence confirms when a vulnerability is actively targeted.

Yes. When a CISA KEV CVE matches a system in your environment that subsequently shows suspicious activity, ManySignal flags the CVE as context in the alert. This prioritises response to exploitable vulnerabilities over theoretical risk.

ManySignal can create Jira or ServiceNow tickets for critical vulnerability findings that correlate with active exploitation indicators. Direct vulnerability remediation (patching) requires integration with patch management tools (Automox, JAMF, etc.).

AWS Security Hub aggregates findings from GuardDuty, Inspector, Macie, and third-party integrations into a single feed. ManySignal ingests Security Hub findings via the Security Hub API and correlates them with CloudTrail and identity events.

Tenable and Qualys vulnerability findings can be ingested via their REST APIs. Contact ManySignal support for current connector availability. AWS Inspector findings are available via the AWS Security Hub integration.

Wiz CSPM identifies misconfigurations, exposed resources, and attack paths in your cloud environment. ManySignal uses this data to enrich runtime alerts with the attack path context — making it immediately clear whether an attacker could exploit the detected activity to reach sensitive data.

ManySignal polls the Wiz API periodically for new Critical and High severity issues. Webhook-based real-time delivery is available for Wiz Enterprise customers. Critical cloud misconfigurations generate alerts in ManySignal within minutes of detection.

Yes. Wiz risk acceptances and AWS Security Hub suppression rules are respected by ManySignal. Accepted risks are excluded from active alerting but remain visible in the investigation timeline for audit purposes.