A detection fires. A container on a production Kubernetes node spawned a shell. Your SOC analyst opens the alert - but by the time they get there, the container is gone. The process tree shows the parent. The script that actually ran? Nowhere to be found.

Was this an attacker? An admin? Legitimate tooling? Without the evidence, every answer is a guess.

This is a significant challenge in cloud security investigation. Workloads spin up and disappear in minutes. Fileless attacks execute entirely in memory, leaving nothing on disk. By the time a SOC analyst starts triage - or an IR team gets the escalation - the artifacts that would answer the critical questions have evaporated with the workload that generated them.

Today, that changes. Wiz Forensics is now generally available and enabled for Wiz Runtime Sensor customers, giving security teams the evidence they need at the moment it matters most - and the AI analysis to make sense of it immediately.

The evidence gap across the threat journey

The challenge of missing evidence affects every stage of how security teams respond to threats. When a detection fires, the SOC analyst’s job is to determine whether the alert is real, urgent, and worth escalating. But alerts routinely arrive without the artifacts needed to confirm scope and intent. The exact script that executed, the binary that was loaded, the files that were accessed - if the workload is gone, so is the evidence. What’s left is metadata: a process name, a parent process, a timestamp. Enough to generate an alert. Not enough to validate one. The result is analysts escalating on partial signals, spending hours manually hunting for context across tools and teams, or worse dismissing threats they couldn’t fully investigate.

For IR teams, the problem compounds at escalation. By the time a ticket lands, the workload is often already recycled. Memory payloads that never touched disk, short-lived container processes, binaries that ran once and exited - none of it survives. Reconstructing what happened becomes forensic guesswork: was persistence established? Did exfiltration occur before the container was destroyed? Without the evidence from the time of the event, these questions can’t be answered with confidence.

The missing link isn’t more detection coverage or faster alerting. It’s automatic, context-aware evidence collection - captured at the moment a threat is detected, scoped to what actually matters for that specific threat, and analysis on the artifacts before an analyst has opened the alert.

Evidence collected at the moment of detection - automatically

Wiz Forensics addresses this by inverting the traditional investigation model. Instead of waiting for an analyst to manually pull artifacts after an alert fires, the Wiz Runtime Sensor automatically collects a forensics package at the moment a detection occurs - capturing the triggering script or binary, process tree, shell histories, SSH configuration, container drift layer, and system logs before the workload has a chance to disappear.

Collection is triggered automatically based on Threat Detection Rules (TDRs), scoped to the specific context of the threat, and available in the Wiz console before an analyst has finished reading the alert.

The difference in investigation outcomes is significant. Take a detection that fires when a database process spawns a bash shell - a common baseline deviation that, on its own, tells you very little. Without a forensics package, the verdict is Low Confidence, Inconclusive because outside the detection, no further information is available.

With the Sensor forensics package, the Wiz Blue Agent analyzes the collected artifacts and finds something different: Postgres logs showing evidence of a SQL injection exploit consistent with the Soco404 cryptomining campaign - plus indicators of active data exfiltration from the database. Verdict flips to High Confidence Malicious, with a reconstructed attack timeline and scoped blast radius, ready for IR handoff.

Same alert. Same detection. Opposite outcome - because the evidence was there.

AI that turns evidence into verdicts

Collecting the right evidence is only half the problem. The other half is analysis - and in most organizations, that burden falls entirely on the analyst.

Wiz Forensics changes this with the Forensics AI Engine, which automatically analyzes Sensor forensics packages the moment it’s collected. Scripts, execution data, logs, and runtime event context are all processed together to surface the top insights from the package - each backed by specific forensic evidence - before an analyst has had to open a single file.

Those insights feed directly into the Blue Agent’s investigation and verdict. The result isn’t a dump of raw artifacts for an analyst to parse. It’s a working conclusion: what happened, what evidence supports it, and what the recommended next steps are.

Consider a detection that fires on an AI agent workload: a suspected reverse shell command line executed on the databot-vm. The process tree tells part of the story - app.py spawned a temporary script, which executed system_report.sh, which ultimately launched a Python reverse shell connecting to openai-gpt-5.com:9001 as root. But the process tree alone can’t tell you what events happened as part of system_report.sh that led to the execution of the reverse shell and whether it’s truly malicious.

The Forensics AI Engine analyzes system_report.sh from the collected package and correlates its contents with runtime evidence - confirming the embedded reverse shell, the RDS database exfiltration pipeline, and the attacker’s persistence activity through SSM agent logs. What the process tree flagged as suspicious, the Forensics Agent confirmed as a coordinated, multi-stage attack - with evidence to back it up. 

This evidence is automatically passed to the Blue Agent - Wiz’s AI investigation agent that correlates detections, cloud context, identity findings, and forensics evidence to produce a complete threat verdict - classified the threat as High Confidence Malicious: a fully reconstructed, multi-stage attack chain from initial prompt injection to data exfiltration, confirmed before an analyst had manually reviewed the detection.

Get started with Wiz Forensics

Wiz Forensics is now generally available and enabled for all Wiz Runtime Sensor customers. If you’re an existing Wiz Runtime Sensor customer you can start seeing forensics collections today as a part of detections collected in your Threats page (login required). To learn more visit the Forensics docs (login required).

If you’re new to Wiz, request a demo to see how Wiz Forensics can help your SOC and IR teams investigate and respond to threats faster.