[wiz] Add Defend V2 Data Stream

packages/wiz/_dev/build/docs/README.md

@@ -6,14 +6,16 @@ The Wiz integration enables you to consume and analyze Wiz data within Elastic S
 
 ## Data streams
 
-The Wiz integration collects five types of data:
+The Wiz integration collects six types of data:
 
 - **Audit** - The Audit log records key events within the Wiz platform, including logins and any mutation API calls executed in the Wiz portal (such as write, edit, delete, and save actions).
 
 - **Cloud Configuration Finding** - A Cloud Configuration Finding is a result generated when a cloud resource does not pass a specific Cloud Configuration Rule.
 
 - **Defend** - Detects and alerts on real-time cloud threats using runtime signals, logs, and Wiz’s security graph via webhook integrations.
 
+- **Defend v2** - Detections generated by Threat Detection Rules, which give enhanced granularity and visibility into network activities and potential security incidents.
+
 - **Issue** - Issues represent active risks or threats identified in your cloud environment.
 
 - **Vulnerability** - Vulnerabilities are weaknesses in computer systems that can be exploited by malicious attackers.
@@ -26,7 +28,6 @@ This integration supports using Elastic Agent or agentless ingestion of data.
 
 Elastic Agent must be installed. For more details, check the Elastic Agent [installation instructions](docs-content://reference/fleet/install-elastic-agents.md).
 
-The minimum **kibana.version** required is **8.10.1**.
 This module has been tested against the **Wiz API Version v1**.
 
 ## Agentless-enabled integration
@@ -55,13 +56,14 @@ Agentless deployments are only supported in Elastic Serverless and Elastic Cloud
 
 ### Required scopes
 
-    | Data Stream   | Scope         |
-    | ------------- | ------------- |
-    | Audit         | admin:audit   |
-    | Issue         | read:issues   |
-    | Vulnerability | read:vulnerabilities |
-    | Cloud Configuration Finding | read:cloud_configuration |
-    | Cloud Configuration Finding Full Posture | read:cloud_configuration |
+    | Data Stream                              | Scope                                                                                |
+    | ---------------------------------------- | ------------------------------------------------------------------------------------ |
+    | Audit                                    | admin:audit                                                                          |
+    | Cloud Configuration Finding              | read:cloud_configuration                                                             |
+    | Cloud Configuration Finding Full Posture | read:cloud_configuration                                                             |
+    | Defend v2                                | read:detections, read:cloud_events_cloud, read:cloud_events_sensor, read:security_scans |
+    | Issue                                    | read:issues                                                                          |
+    | Vulnerability                            | read:vulnerabilities                                                                 |
 
 ### Collect logs (Defend) via HTTP Endpoint
 
@@ -153,6 +155,16 @@ This is the `Defend` dataset.
 
 {{fields "defend"}}
 
+### Defend v2
+
+This is the `Defend v2` dataset.
+
+#### Example
+
+{{event "defend_v2"}}
+
+{{fields "defend_v2"}}
+
 ### Issue
 
 This is the `Issue` dataset.

packages/wiz/_dev/deploy/docker/docker-compose.yml

@@ -65,6 +65,19 @@ services:
       - http-server
       - --addr=:8090
       - --config=/files/config-vulnerability.yml
+  wiz-defend_v2:
+    image: docker.elastic.co/observability/stream:v0.22.0
+    hostname: wiz-defend_v2
+    ports:
+      - 8090
+    volumes:
+      - ./files:/files:ro
+    environment:
+      PORT: '8090'
+    command:
+      - http-server
+      - --addr=:8090
+      - --config=/files/config-defend_v2.yml
   wiz-defend-no-auth:
     image: docker.elastic.co/observability/stream:v0.22.0
     volumes: