Wiz
Outline
Introduction
SAFE integrates with Wiz Cloud Security Platform to continuously ingest cloud asset inventory, vulnerabilities, cloud misconfigurations, compliance findings, network exposure information, and security issues.
The integration enables organizations to correlate Wiz findings with business context and prioritize remediation based on cyber risk.
The connector uses the Wiz GraphQL APIs secured with OAuth 2.0 Client Credentials authentication.
What SAFE Imports from Wiz
SAFE imports the following security data from Wiz.
| Data category | Description |
|---|---|
| Inventory (Assets) | Cloud resources including VMs, containers, buckets, databases, and related services |
| Vulnerabilities | CVE findings on supported asset types |
| Cloud Misconfigurations | Configuration findings such as open buckets, insecure settings, and encryption gaps |
| Host Configuration | Host-level rule assessments and hardening checks |
| Controls / Issues | Wiz issues tied to entities, including toxic combinations and framework mappings |
| Network Exposure | Exposure data surfaced as tags, including internet access and privilege context |
Supported Asset Type
The connector supports 112+ asset types across multiple cloud categories and also auto-discovers additional types available in your Wiz tenant, allowing newly introduced resource types to be ingested automatically.
| Asset Category | Asset Types |
|---|---|
| AI System | AI_AGENT, AI_DATASET, AI_DEPLOYMENT, AI_EXTENSION, AI_GUARDRAIL, AI_MODEL, AI_PIPELINE, AI_SERVICE, AI_TOOL |
| Compute | COMPUTE_INSTANCE_CONFIGURATION, COMPUTE_INSTANCE_GROUP, SERVERLESS, SERVERLESS_PACKAGE, VIRTUAL_DESKTOP, VIRTUAL_MACHINE, VIRTUAL_MACHINE_IMAGE, VIRTUAL_WORKSPACE, VIRTUAL_WORKSTATION, WORKSTATION |
| Containers & Kubernetes | CONTAINER, CONTAINER_GROUP, CONTAINER_IMAGE, CONTAINER_REGISTRY, CONTAINER_REPOSITORY, CONTAINER_SERVICE, KUBERNETES_CLUSTER, MCP_SERVER, SECRET_CONTAINER |
| Storage | BUCKET, FILE_SYSTEM_SERVICE, HYBRID_STORAGE_SERVICE, SNAPSHOT, STORAGE_ACCOUNT, VOLUME |
| Database | DATABASE, DATA_CATALOG, DATA_PROCEDURE, DATA_WORKFLOW, DATA_WORKLOAD, DATASET_CONFIGURATION, DB_SERVER, MAP_REDUCE_CLUSTER, METADATA_REPOSITORY, SCHEMA_CONFIGURATION, SEARCH_INDEX |
| Network | API_GATEWAY, CDN, DNS_PRIVATE_RESOLVER, DNS_ZONE, FIREWALL, FIREWALL_CONFIGURATION, GATEWAY, IP_ADDRESS_GROUP, IP_ADDRESS_POOL, LOAD_BALANCER, NAT, NETWORK_APPLIANCE, NETWORK_INTERFACE, NETWORK_MANAGEMENT_SERVICE, PRIVATE_ENDPOINT, PRIVATE_LINK, PROXY, ROUTE_TABLE, SUBNET, SWITCH, TARGET_GROUP, TELECOM_NETWORK, VIRTUAL_NETWORK |
| Identity & Access | ACCESS_KEY, SERVICE_ACCOUNT, USER_ACCOUNT |
| Configuration & Secrets | CLOUD_LOG_CONFIGURATION, DATA_NETWORK_POLICY, RAW_ACCESS_POLICY, SECRET |
| Cloud Organization | CLOUD_ORGANIZATION, RESOURCE_GROUP, SUBSCRIPTION |
| Governance | GOVERNANCE_POLICY, GOVERNANCE_POLICY_GROUP |
| Services | ARTIFACT_REGISTRY, ARTIFACT_REPOSITORY, BACKUP_SERVICE, CALL_CENTER_SERVICE, CICD_SERVICE, COLLABORATION_WORKSPACE, COMMUNICATION_SERVICE, DEDICATED_INFRASTRUCTURE, DEVELOPMENT_SERVICE, EMAIL_SERVICE, ENCRYPTION_KEY, IO_T_DEVICE, IO_T_DEVICE_GROUP, IO_T_JOB, IO_T_ROUTING_RULE, MAILBOX, MANAGED_CERTIFICATE, MANAGED_JUMP_SERVER, MANAGEMENT_SERVICE, MEDIA_SERVICE, MESSAGING_SERVICE, MONITOR_ALERT, MONITOR_SERVICE, SERVICE_BLUEPRINT, SERVICE_CONFIGURATION, SERVICE_DISCOVERY_ENDPOINT, SERVICE_DISCOVERY_NAMESPACE, SERVICE_DISCOVERY_SERVICE, SERVICE_QUOTA, SIMULATION_SERVICE, VIRTUAL_DRIVE, WEB_SERVICE |
Supported Asset Types for Vulnerabilities
Wiz vulnerabilities are only available for the following six asset types:
VIRTUAL_MACHINE
SERVERLESS
DATABASE
DB_SERVER
CONTAINER_IMAGE
CONTAINER
Tags
SAFE associates three tag groups with Wiz assets.
Native Wiz Tags
All key-value tags configured on cloud resources in Wiz are ingested as-is.
Auto-Generated Tags
| Tag | Source |
|---|---|
| Asset Type | Resource type from Wiz |
| Cloud Platform | Cloud provider such as AWS, Azure, or GCP |
| Wiz-Status | Resource status from Wiz |
| Wiz-Zone | Availability zone |
| Wiz-Instance-Type | Instance type |
Network Exposure Tags
| Tag | Description |
|---|---|
| Wiz-NW-Exposure-Type | Type of network exposure |
| Wiz-Accessible-From-Internet | Whether the asset is accessible from the internet |
| Wiz-Has-Admin-Privileges | Whether the asset has admin privileges |
| Wiz-Has-High-Privileges | Whether the asset has high privileges |
| Wiz-Sensitive-Data | Whether the asset has sensitive data |
| Wiz-Is-Ephemeral | Whether the asset is ephemeral |
| Wiz-Is-Managed | Whether the asset is managed |
| Wiz-Open-To-All-Internet | Whether the asset is open to all internet |
| Wiz-Password-Auth-Disabled | Whether password authentication is disabled |
| Wiz-NW-Exposure-Region | Network exposure region |
Data Synchronization Behavior
| Operation | Behavior |
|---|---|
| Initial Sync | Imports all supported data |
| Incremental Sync | Not Supported |
| Auto Sync | Configurable (Default: 7 days) |
| Manual Sync | Supported |
Permissions
To enable the SAFE integration, create a dedicated Wiz Service Account with the required API scopes. These permissions allow SAFE to securely retrieve asset inventory, vulnerabilities, cloud posture, compliance findings, and related security metadata from your Wiz environment.
SAFE recommends granting the read:all scope for simplified configuration. Alternatively, you can assign only the individual API scopes listed below to follow the principle of least privilege.
Note
Read-only permissions are sufficient for data ingestion. The create:reports and update:reports permissions are required only if your organization intends to use report generation or report scheduling capabilities.
| Wiz API permission | Why it is needed |
|---|---|
read:resources |
Fetches cloud inventory and supports asset type discovery, and fetches the network exposure data as well. |
read:vulnerabilities |
Fetches software vulnerability findings across supported assets |
read:cloud_configuration |
Fetches cloud configuration and misconfiguration findings |
read:host_configuration |
Fetches host-level configuration assessments and hardening checks |
read:issues |
Fetches Wiz issues, toxic combinations, and framework mappings |
Generate Connection Details
Get the Wiz API Base URL (API Endpoint URL)
Log in to your Wiz account.
Click the User Profile icon in the top-right corner and select User Settings.
From the left options menu, select Tenant. The API Endpoint URL will be displayed (e.g., https://api.<region>.app.wiz.io/graphql).
Copy and save the API Endpoint URL (Base URL) to use when configuring the Wiz connector in SAFE.
| Environment | Domain | Example |
|---|---|---|
| Commercial (Standard) | app.wiz.io |
https://api.us1.app.wiz.io/graphql |
Get the Wiz API Auth URL
| Tenant type | Auth URL |
|---|---|
| Commercial (Cognito) | https://auth.app.wiz.io/oauth/token |
| Commercial (Auth0) | https://auth.wiz.io/oauth/token |
Get the Client ID and Client secret
Log in to your Wiz account.
Go to Settings > Service Accounts.
Click Add Service Account.
Enter a service account name such as SAFE Integration.
From the Type drop-down menu, select Custom Integration (GraphQL API).
Select a project to limit the scope of this service account to specific projects, or configure the account with a global scope for broader visibility.
In the API Scopes section, select the permissions listed in the Permissions section above.
Click Add Service Account to generate and display the Client ID and Client Secret. Copy and save the values as these will no longer be visible after you leave the page.
Note
>
Client ID and Client Secret values will no longer be visible after you leave the page.
Configure Wiz in SAFE
Log in to SAFE as admin and navigate to Integrations on the left navigation
Click on the + icon on the top right of the page.
Click Wiz from the list.
Enter a unique Integration Name.
Enter the API Base URL, API Auth URL, Client ID, and Client Secret obtained from Wiz. Refer to Generate Connection Details.
Ingestion Mode (default: Wiz Full Security Sync): Select one:
- Wiz Inventory Sync – Sync only your cloud asset inventory from Wiz into SAFE. This includes hosts, workloads, and cloud resources for visibility.
- Wiz Full Security Sync – Sync both your cloud asset inventory and associated security findings from Wiz into SAFE. This includes vulnerabilities, misconfigurations, and issues.
Asset last seen days filter (default: 1 day) : Enter the maximum age (in days) of assets to be considered while ingesting data from the source. Assets not seen within this time range will be excluded.
Enter the Auto Sync frequency in number of days (default: 7) . Specify how often (in days) SAFE should automatically synchronize data from the source.
Select the checkboxes based on your business requirement:
- Ingest Images Only with Running Containers (default: enabled): When enabled, only container images with active running containers are ingested. When disabled, eligible container images can be ingested even without running containers.
- Ingest Container Assets (default: enabled): When enabled, ingests running containers and their associated vulnerabilities. When disabled, container assets are not ingested.
- Include vulnerabilities without related issues for low-fidelity detection methods (default: enabled): When enabled, includes vulnerabilities even if they are not related to Wiz issues. When disabled, reduces noise by excluding lower-confidence vulnerability detections. High-fidelity detection methods include OS, installed software, software installed from a service, default packages, and packages, while other methods, such as file paths and libraries, are excluded.
- Ignore Assets Without Findings (default: disabled): When enabled, skips assets that have zero findings. When disabled, ingests assets even if no findings are present.
- Include Informational Issues (default: disabled): When enabled, includes Informational-severity issues. When disabled, only Critical, High, Medium, and Low issues are synced.
- Include Threat Detection Issues (default: disabled): When enabled, includes Wiz Defend / CDR events if licensed. When disabled, threat detection issues are excluded.Click the Test Connection.
Asset Types to Ingest (default: all discovered types): Leave empty to ingest all discovered types, or add specific Wiz asset types such as VIRTUAL_MACHINE, SERVERLESS, DATABASE, CONTAINER_IMAGE, or CONTAINER.
Once the connection is verified, click Save.
Once the integration is saved, click on Sync Now to trigger an on-demand sync.
API Details
| Setting | Value |
|---|---|
| GraphQL Endpoint | https://api.<region>.app.wiz.io/graphql |
| Authentication | OAuth 2.0 Client Credentials. Use the Auth URL listed above for your tenant type. |
API Rate Limit
SAFE follows Wiz API rate limiting guidelines. The connector:
Uses cursor-based pagination
Supports page sizes up to 500 records where supported
Automatically refreshes expired OAuth tokens
Retries transient failures
Automatically backs off when HTTP 429 Too Many Requests responses are received
Resumes synchronization after interruptions without duplicating data
Limitations
- Software Inventory LimitationWiz does not provide a dedicated Software Inventory API. As a result, SAFE does not ingest a complete list of installed software from Wiz. Instead, SAFE derives software information from vulnerability findings (CVEs) returned by the Wiz APIs. Software is displayed only when it is associated with a vulnerability identified by Wiz. Assets without vulnerability findings may not display installed software, even if the software exists on the asset.
FAQs
How often does SAFE synchronize with Wiz?
SAFE supports both manual synchronization and scheduled automatic synchronization. The default Auto Sync interval is 7 days but can be customized.
Does SAFE import existing historical findings?
Yes. During the initial synchronization, SAFE imports all available supported data from Wiz.
Does SAFE support incremental synchronization?
Yes. After the initial import, SAFE retrieves only new or updated findings wherever incremental APIs are available.
What happens if the API rate limit is exceeded?
SAFE automatically waits for the retry interval provided by Wiz and resumes synchronization.
Does SAFE deduplicate assets?
Yes. SAFE correlates and deduplicates assets using unique cloud and resource identifiers.
Which cloud platforms are supported?
The integration supports all cloud platforms supported by Wiz, including AWS, Microsoft Azure, Google Cloud Platform, Kubernetes, containers, and cloud-native services.
Why doesn't SAFE display software for all assets imported from Wiz?
Wiz does not provide a dedicated Software Inventory API. SAFE derives software information from vulnerability (CVE) findings returned by the Wiz APIs. As a result, software is displayed only when it is associated with a vulnerability identified by Wiz. Assets without vulnerability findings may not display installed software, even if software is present on the asset.
Why is an asset visible in Wiz but not imported into SAFE?
SAFE imports only the assets returned by the Wiz APIs using the configured service account credentials. If an asset is visible in the Wiz UI but is not imported into SAFE, verify that the asset is included in the Wiz Project associated with the service account configured in SAFE. Assets outside the scope of the configured project or inaccessible to the service account cannot be retrieved through the Wiz APIs and therefore cannot be ingested into SAFE.
Can I limit the data imported into SAFE?
Yes. SAFE provides configuration options to:
- Import only running container images
- Import only containers with vulnerabilities
- Exclude low-fidelity vulnerability detections
- Filter assets based on the last seen date
Did this article help?
Let us know by leaving a star rating at the top of this article.