Back to Devoured - August 05, 2026
DEVOURED
Add security context to operational investigations with AWS DevOps Agent and Wiz

Add security context to operational investigations with AWS DevOps Agent and Wiz

DevOps securityai Amazon Web Services
AWS DevOps Agent now uses Wiz's security graph via MCP to instantly distinguish between operational performance issues and active security exploits.
What: The integration queries Wiz’s vulnerability and threat database during AWS DevOps Agent investigations, allowing for automated triage that flags critical risks like exposed RCEs alongside CPU spikes.
Why it matters: Merging operational and security context eliminates the 'manual triage bottleneck' where engineers must switch between multiple dashboards during incidents to find the root cause.
Takeaway: Register the Wiz MCP server in your AWS DevOps Agent console and allowlist the Wiz tools to enable automated security auditing during incident response.
Deep dive
  • Uses the Model Context Protocol (MCP) to bridge AWS operational data and Wiz security intelligence.
  • Automatically audits affected resources for CVEs, public exposure, and active malware when an operational alarm fires.
  • Enables the agent to classify incidents into: operational-only, security-compromised, or unmonitored.
  • Remediation steps (via Wiz Green Agent) are attached directly to the incident report.
  • The integration is extensible and does not require custom middleware or proprietary code on the user's side.
  • Wiz provides a standard MCP gateway (https://mcp.app.wiz.io) for these queries.
Decoder
  • MCP (Model Context Protocol): An open-source protocol that allows AI models and agents to interact with external data sources and tools consistently.
  • RCE (Remote Code Execution): A security flaw that allows an attacker to execute arbitrary code on a remote server.
Original article

Add security context to operational investigations with AWS DevOps Agent and Wiz

When an on-call engineer receives an alert at 2 AM, a CPU spike, a latency anomaly, or an unexpected API error, the first question is whether this is an operational issue or a security incident. A CPU spike could be a scaling problem or a cryptominer. A latency anomaly could be a bad deployment or data exfiltration. Without security context in the investigation loop, engineers lack the information to distinguish between the two, delaying resolution and increasing risk.

AWS DevOps Agent is a frontier agent that autonomously investigates incidents and identifies operational improvements across AWS, multicloud, and on-premises environments. It reduces mean time to resolution (MTTR) by performing the triage and investigation work that would otherwise take an on-call engineer hours of manual effort. With the Wiz integration, AWS DevOps Agent queries Wiz’s security graph during investigations through the Model Context Protocol (MCP), surfacing vulnerability data, security findings, and exposure analysis alongside operational telemetry so engineers can quickly determine whether an alert is a performance issue or a security incident.

In this post, we walk through how the integration works, demonstrate a real-world incident investigation where AWS DevOps Agent uses Wiz MCP to surface a critical vulnerability behind an API latency spike, and show how to configure the integration in your environment. If you already use Wiz to secure your AWS environment, this integration puts your existing security data to work during incident investigations.

AWS DevOps Agent

AWS DevOps Agent investigates incidents and identifies operational improvements as an experienced DevOps engineer would: by learning your resources and their relationships, working with your observability tools, runbooks, code repositories, and CI/CD pipelines, and correlating telemetry, code, and deployment data across all of them.

AWS DevOps Agent is extensible through MCP, which allows the agent to call external tools during its investigation without requiring custom development. This is the mechanism that makes the Wiz integration possible. When the agent identifies a resource under investigation, it queries Wiz MCP for security findings associated with that resource and incorporates the results into its analysis and recommendations.

Wiz MCP

Wiz is designed to secure cloud and AI applications through a unified, graph-powered platform. The Wiz Security Graph connects infrastructure, identities, data, AI components, and runtime activity into a single contextual view. This approach identifies toxic combinations across layers – where exposures, permissions, data access, AI vulnerabilities, and runtime behaviors intersect in ways attackers can realistically exploit.

The Wiz MCP Server acts as a standardized gateway that allows AWS DevOps Agent to query this security graph during investigations. Wiz knows whether your Amazon Elastic Compute Cloud (Amazon EC2) instance has an exploitable Common Vulnerabilities and Exposures (CVE), whether it is publicly exposed, and whether endpoint protection is in place. AWS DevOps Agent, looking at the same instance, knows that CPU spiked, and a deployment happened 20 minutes ago. Separately, each tool tells a partial story. Together, they give the engineer the complete picture needed to act.

Better together: how combined context changes triage

The value of this integration is easiest to understand through three scenarios. Each starts with the same operational signal: a CPU spike on an EC2 instance.

Scenario A: No security findings. A CPU spike fires on an instance. AWS DevOps Agent queries Wiz and confirms the instance is fully monitored, has no known vulnerabilities, and shows zero active threat detections. This is an operational issue. The engineer scales, investigates the deployment, tests, and moves on.

Scenario B: Security issue detected. The same CPU spike fires, the same Amazon CloudWatch alarm triggers, and the same engineer wakes up. But when AWS DevOps Agent queries Wiz, it finds a validated remote code execution vulnerability on that instance, confirmed exploitable, with the resource exposed to the internet. The operational symptoms are identical to Scenario A. The correct response is the opposite: isolate immediately, engage your security team, treat this as a potential compromise.

Scenario C: Wiz coverage gap. The resource isn’t in Wiz at all. AWS DevOps Agent includes this as a finding in the investigation report, noting that no security context was available for the resource. Your team can then address the coverage gap by onboarding the resource into Wiz.

How the integration works: the MCP bridge

The integration uses MCP, the same protocol AWS DevOps Agent uses for many of its external tool connections. When the agent identifies affected resources during an investigation, it calls Wiz’s remote MCP server as part of its evidence collection – no separate step, no manual trigger. The security query happens alongside the operational investigation, not after it. During the MCP call, AWS DevOps Agent sends resource identifiers to Wiz’s MCP endpoint and receives security findings in response. No operational telemetry or broader investigation context is shared with Wiz.

Wiz MCP Tool What it tells the agent
list_cloud_resources Whether Wiz monitors this resource at all (coverage check)
list_findings All finding types in one call: vulnerabilities, misconfigurations, secrets, data, and host config
list_vulnerability_findings Deep CVE detail – severity, fix version, and exploitability
list_issues Prioritized risk issues, including toxic combinations
list_threats / list_malware_findings Active threats and malware: cryptomining, data exfiltration, backdoors
list_detections Recent threat detection signals and anomalous activity
get_green_agent_analysis AI-generated remediation steps for the issues found

The agent runs these queries together through a single security-auditing skill that loads automatically when it connects to Wiz’s MCP server with the DevOps toolset, so the full security picture comes back in seconds. If the Wiz MCP server is unreachable, times out mid-query, or returns an authentication error, the agent continues its investigation with the operational data it has and flags the missing security context in the investigation findings (Scenario C).

Getting started

Prerequisites

  1. An active AWS DevOps Agent configuration with at least one Agent Space.
  2. A Wiz tenant with a remote MCP server endpoint (Streamable HTTP transport).
  3. Authentication credentials for the Wiz MCP server.

Enabling the integration

Step 1: Register the Wiz MCP server at account level

  1. Sign in to the AWS Management Console and navigate to the AWS DevOps Agent console.
  2. Go to the Capability Providers page from the side navigation.
  3. Find MCP Server in the Available providers section and choose Register.
  4. Enter the Wiz MCP server details.
  5. Select the authentication method that matches your Wiz MCP server configuration.
  6. Review your configuration and choose Submit.

Step 2: Allowlist Wiz tools in your Agent Space

  1. In the AWS DevOps Agent console, select your Agent Space.
  2. Go to the Capabilities tab.
  3. In the MCP Servers section, choose Add.
  4. Select the registered Wiz MCP server.
  5. Select all the Wiz MCP tools.
  6. Choose Add.

Step 3: Choose how the Wiz security audit runs

  1. Use the Wiz skill tool (recommended). With the Wiz MCP tools allowlisted, AWS DevOps Agent automatically runs the latest devops_resource_auditing_skill workflow from Wiz during investigations.
  2. Import the ready-made skill. Import the wiz-security-context skill from the AWS DevOps Agent skills repo directly into your Agent Space.
  3. Create your own custom skill. Use AWS DevOps Agent’s Create skill with Chat to build a custom skill based on the devops_resource_auditing_skill workflow.

The power of co-build: extending context through MCP

This integration started from a recurring customer question: how do I know if what I’m seeing is an operational problem or an active attack? We worked with Wiz to close this gap. AWS DevOps Agent provides operational investigation and reasoning; Wiz provides cloud security intelligence. MCP provided the integration path without either side needing to reimplement what the other already does well.

Conclusion

Operational incidents and security incidents often start with the same symptoms. The difference between the right response to each is context that lives in a different tool than the one that fired the alert. The AWS DevOps Agent and Wiz integration brings that context into the investigation loop automatically through MCP.

Explore all 55 articles in today's digest

Fresh dev news, AI-digested daily. Never miss a trend at devoured.fyi