Skip to main content

Wiz

Visualize Wiz Vulnerability Findings and monitor changes through queries and alerts.

Installation​

info

You will need the following parameters:

  • Active service account

    • A Wiz service account serves as a machine-to-machine interface to authenticate with the Wiz API. Permissions must be explicitly assigned to a service account by a Wiz user, typically requiring a user with elevated privileges such as a Global Admin. See their documentation for more information.
    • Required API scopes:
      • read:users
      • read:projects
      • read:resources
      • read:host_configuration
      • read:cloud_configuration
      • read:reports
      • create:reports
      • read:vulnerabilities

  • OAuth Client ID and OAuth Client Secret obtained from the service account

  • Access Token API URL — Example: https://auth.app.wiz.io/oauth/token

  • GraphQL API URL — Example: https://api.<TENANT_DATA_CENTER>.<ENVIRONMENT>/graphql

    • <TENANT_DATA_CENTER> is your Wiz regional data center (e.g., us1, us2, eu1, or eu2)
    • <ENVIRONMENT> is one of app.wiz.io, app.wiz.us, or gov.wiz.io

To install the Wiz integration in JupiterOne, navigate to the Integrations tab in JupiterOne and select Wiz. Click New Instance to begin configuring your integration.

Creating a Wiz instance requires the following:

  • The Account Name used to identify the Wiz account in JupiterOne. Ingested entities will have this value stored in tag.AccountName when the AccountName toggle is enabled.

  • Description to assist in identifying the integration instance, if desired.

  • Polling Interval that you feel is sufficient for your monitoring needs. You may leave this as DISABLED and manually execute the integration.

  • Your Wiz Access Token API URL.

  • Your Wiz GraphQL API URL.

  • Your Wiz OAuth Client ID and OAuth Client Secret.

Click Create once all values are provided to finalize the integration.

Data Volume Configuration​

These optional settings control how much data is ingested on each run. Narrowing severity and status filters reduces ingestion volume and run time.

Ingestion Windows​

Each finding type has an independent ingestion window. Only findings updated (or first seen, if Filter by First Seen is enabled) within the selected number of days are ingested.

FieldDescriptionDefault
Ingestion Window (days) — VM Host VulnerabilitiesHow many days back to ingest VM host vulnerability findings.90
Ingestion Window (days) — Host Configuration FindingsHow many days back to ingest host configuration findings.90
Ingestion Window (days) — Bucket VulnerabilitiesHow many days back to ingest bucket vulnerability findings.90
Ingestion Window (days) — Container VulnerabilitiesHow many days back to ingest container vulnerability findings.90
Ingestion Window (days) — Container Image VulnerabilitiesHow many days back to ingest container image vulnerability findings.90
Ingestion Window (days) — Serverless VulnerabilitiesHow many days back to ingest serverless vulnerability findings.90
Ingestion Window (days) — VM Image VulnerabilitiesHow many days back to ingest VM image vulnerability findings.90

Available options for all ingestion window fields: 90, 180, 275, 365 (days).

Data Filtering Options​

VM Host Vulnerability Findings​

FieldDescriptionDefaultOptions
SeverityVendor severity levels to include.CriticalCritical, High, Medium, Low, None
StatusStatus values to include.Open, ResolvedOpen, Resolved, Rejected

Host Configuration Findings​

FieldDescriptionDefaultOptions
SeveritySeverity levels to include.CriticalCritical, High, Medium, Low, Informational
StatusStatus values to include.OpenOpen, Resolved, Rejected

Bucket Vulnerability Findings​

FieldDescriptionDefaultOptions
SeverityVendor severity levels to include.Critical, HighCritical, High, Medium, Low, None
StatusStatus values to include.Open, ResolvedOpen, Resolved, Rejected

Container Vulnerability Findings​

FieldDescriptionDefaultOptions
SeverityVendor severity levels to include.Critical, HighCritical, High, Medium, Low, None
StatusStatus values to include.Open, ResolvedOpen, Resolved, Rejected

Container Image Vulnerability Findings​

FieldDescriptionDefaultOptions
SeverityVendor severity levels to include.Critical, HighCritical, High, Medium, Low, None
StatusStatus values to include.Open, ResolvedOpen, Resolved, Rejected

Serverless Vulnerability Findings​

FieldDescriptionDefaultOptions
SeverityVendor severity levels to include.Critical, HighCritical, High, Medium, Low, None
StatusStatus values to include.Open, ResolvedOpen, Resolved, Rejected

VM Image Vulnerability Findings​

FieldDescriptionDefaultOptions
SeverityVendor severity levels to include.Critical, HighCritical, High, Medium, Low, None
StatusStatus values to include.Open, ResolvedOpen, Resolved, Rejected

Cloud Configuration Findings​

FieldDescriptionDefaultOptions
SeveritySeverity levels to include.Critical, HighCritical, High, Medium, Low, None
StatusStatus values to include.OpenOpen, Resolved, Rejected
ResultResult values to include.FailFail, Pass, Error, Not Assessed

Advanced Configuration​

FieldDescriptionDefault
Filter by First SeenWhen enabled, the ingestion window date filter uses the finding's First Seen date instead of Updated At. Applies to all vulnerability types.Disabled
Use Severity instead of Vendor SeverityWhen enabled, filters vulnerability findings by Severity instead of Vendor Severity. Applies to all vulnerability types.Disabled
Ingest findings of missing and deleted assetsWhen enabled, vulnerability findings are retained even when their source asset was not ingested (for example, when the asset belongs to a Wiz project not configured for ingestion, or was deleted). A minimal host record is reconstructed from the finding so the finding is not dropped. Recently-deleted assets still within Wiz's retention window are also ingested with their deleted status.Disabled
Project IDs to ingestAn optional list of Wiz project IDs to ingest. When set, only assets and findings belonging to these projects are collected. Provide IDs separated by commas.All projects
Map assets to ServiceNow CMDBWhen enabled, mapped relationships are emitted from Wiz assets (hosts, containers, serverless functions) to ServiceNow CMDB records, matched by the asset's app ID tag and subscription external ID. Enable only for tenants whose Wiz app ID tag holds a ServiceNow sys_id.Disabled
App ID tag keyThe asset tag key whose value is the ServiceNow application/service sys_id. Case-sensitive — must match the tag key exactly as it appears in Wiz. Used only when Map assets to ServiceNow CMDB is enabled.appid
Support group tag keyAsset tag key whose value identifies the responsible support group or team. When set, the tag value is promoted onto the supportGroup property of Wiz asset entities so it is queryable without knowing the raw tag key. Case-sensitive.Not set
Support owner tag keyAsset tag key whose value is the operational or support owner (typically an email address). Promoted onto the supportOwner property of Wiz asset entities. Case-sensitive.Not set
Business owner tag keyAsset tag key whose value is the business owner (typically an email address). Promoted onto the businessOwner property of Wiz asset entities. Case-sensitive.Not set

Next steps​

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our Instance management guide to learn more about working with and editing integration instances.