Fix Wiz Defend Passthrough severity function

[arielkr256]

Summary

• Fixes INFO: severity method for detection with id [Wiz.Defend.Alert.Passthrough] yielded [INFORMATIONAL], expected [['INFO', 'LOW', 'MEDIUM', 'HIGH', 'CRITICAL']] #2057. The severity() function in Wiz.Defend.Alert.Passthrough was returning INFORMATIONAL, which is not in Panther's allowed set (INFO, LOW, MEDIUM, HIGH, CRITICAL).
• Maps INFORMATIONAL → INFO, passes through allowed values, and falls back to DEFAULT otherwise — mirroring the recent FDR Passthrough fix in Fix FDR Passthrough Severity Function #2056.

Test plan

• pipenv run panther_analysis_tool test --filter RuleID=Wiz.Defend.Alert.Passthrough passes (High/Low/Informational test cases)
• make fmt && make lint pass via pre-commit

🤖 Generated with Claude Code

[cursor]

PR Summary

Medium Risk
Changes alert severity normalization and dedup behavior for Wiz Defend passthrough events, which can affect alert routing, prioritization, and grouping. Scope is small and localized to one rule file.

Overview
Fixes Wiz.Defend.Alert.Passthrough severity handling by normalizing the incoming event.severity to Panther’s allowed set: maps INFORMATIONAL to INFO, passes through known values, and falls back to DEFAULT for anything else.

Updates dedup() to treat INFORMATIONAL like other low-severity alerts (INFO/LOW) when choosing the lower-noise tdrId-based dedup key.

^{Reviewed by Cursor Bugbot for commit 78b20f7. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 3660bfb. Configure here.}