Wiz

View as Markdown

Community Platform

runZero imports data from the Wiz API to sync your cloud assets, software, and vulnerabilities from Wiz, for better visibility of your cloud assets and security posture.

Getting started with Wiz

To set up the Wiz integration:

  1. Create a Service Account in Wiz with permissions to read graph resources, read reports, and create reports.
  2. Add the Wiz credential to runZero.
  3. Choose whether to run the integration as a scan probe or a connector task.
  4. Activate the integration to pull your data into runZero.

Requirements

  • Administrator access to the Wiz portal.

Step 1: Create a Service Account in Wiz

  1. Sign in to Wiz with an Administrator account.
  2. Go to Settings > Access Management > Service Accounts > Add Service Account.
  3. Enter a descriptive name in the Name field.
  4. For Type, select Custom Integration (GraphQL API).
  5. Under Projects, select the projects the Service Account can access, or leave it blank to allow all projects.
  6. For API Scopes, enable read:resources, read:reports, and create:reports.
  7. Click Add Service Account and copy the Client ID and Client Secret.
  8. Go to User Settings > Tenant and copy the API Endpoint URL, which has the format https://api.{{region}}.app.wiz.io/.

Step 2: Add the Wiz credential to runZero

  1. Go to the Credentials page in runZero and name the credential, for example Wiz.
  2. Choose Wiz Client Secret from the list of credential types.
  3. Using the service account you created on the settings page in the Wiz portal, fill in the fields:
    • In Wiz Client ID, enter the client ID of your Wiz service account.
    • In Wiz Client Secret, enter the client secret of your Wiz service account.
    • In Wiz Auth URL, enter the URL used to authenticate the Wiz service account.
    • In Wiz API URL, enter the API Endpoint URL for the Wiz API.
  4. To share this credential with other organizations, select Make this a global credential. Otherwise, you can grant access per organization.
  5. Save the credential.

Step 3: Choose how to configure the Wiz integration

You can run the Wiz integration as a scan probe or a connector task. A scan probe gathers integration data during a scan task. A connector task runs on its own, from the cloud or from one of your Explorers, and performs only the integration sync.

Step 4: Set up and activate the integration to sync data

Step 4a: Configure the Wiz integration as a connector task

A connection needs a schedule and a site. The schedule sets when the sync runs, and the site is where runZero creates any new Wiz-only assets.

  1. Activate a connection to Wiz. You can also reach every third-party connection from the integrations page, your inventory, or the tasks page.
  2. Choose the credentials you added earlier. If they aren’t listed, check that they have access to your current organization.
  3. Set the severity and risk levels to import (optional).
  4. Set the Fingerprint only toggle to Yes to use vulnerability records for fingerprint analysis without storing them in your runZero vulnerability inventory (optional).
  5. Enter a name for the task, like Wiz Sync (optional).
  6. Choose the Explorer that runs this connector task (optional).
  7. Choose the site for your assets. runZero stores all newly discovered assets there.
  8. Enter a description for the task (optional).
  9. To leave out assets runZero hasn’t scanned, switch the Exclude unknown assets toggle to Yes. The import includes them by default.
  10. To leave out assets that haven’t been assessed for vulnerabilities, switch the Include unscanned assets toggle to No.
  11. Schedule the sync to run once or on a recurring schedule, starting on the date and time you set.
  12. Activate the connection. The sync runs on your schedule, and the Scheduled tasks page shows when the next one will run.

Step 4b: Configure the Wiz integration as a scan probe

Run the Wiz integration as a scan probe to have the runZero Explorer pull your Wiz assets into the runZero Console.

In a new or existing scan configuration:

  • Set the WIZ option to Yes in the Probes and SNMP tab and change any default options you need.
  • Optionally, set the severity and risk levels for ingested vulnerability results.
  • Set the correct Wiz credential to Yes in the Credentials tab.

Step 5: View Wiz assets, software, and vulnerabilities

After a successful sync, your Wiz assets appear in your inventory with a Wiz icon in the Source column.

The integration also gathers the software and vulnerabilities Wiz detected. Go to Inventory > Software or Inventory > Vulnerabilities to view them.

To filter by Wiz assets, run this query:

Open an asset to see the attributes runZero gathered from Wiz.

Troubleshooting

If you’re having trouble with the integration, start with these questions and answers.

Why is the Wiz integration unable to connect?

  1. Check whether the Wiz integration is returning any data.
    • Query the inventory rather than the task details to review all the data available from this integration.
    • In some cases, an integration’s configuration limits how much data reaches the runZero console.
  2. Some integrations require specific actions that are easy to overlook. If you miss a step during setup, the integration may not work correctly. Review this page and follow the steps exactly.
    • Double-check the API Scopes on the Wiz service account. A valid account that lacks the required permissions fails the import.
  3. If the Wiz integration can’t connect, check the task log for errors. Common errors include:
    • 500: server error, unable to connect to the endpoint
    • 404: hitting an unknown endpoint on the server
    • 403: not authorized, likely a credential issue
Updated