Introduction

SAFE integrates with Wiz Cloud Security Platform to continuously ingest cloud asset inventory, vulnerabilities, cloud misconfigurations, compliance findings, network exposure information, and security issues.

The integration enables organizations to correlate Wiz findings with business context and prioritize remediation based on cyber risk.

The connector uses the Wiz GraphQL APIs secured with OAuth 2.0 Client Credentials authentication.

What SAFE Imports from Wiz

SAFE imports the following security data from Wiz.

Data category	Description
Inventory (Assets)	Cloud resources including VMs, containers, buckets, databases, and related services
Vulnerabilities	CVE findings on supported asset types
Cloud Misconfigurations	Configuration findings such as open buckets, insecure settings, and encryption gaps
Host Configuration	Host-level rule assessments and hardening checks
Controls / Issues	Wiz issues tied to entities, including toxic combinations and framework mappings
Network Exposure	Exposure data surfaced as tags, including internet access and privilege context

Supported Asset Types

The connector supports 112+ asset types across multiple cloud categories and also auto-discovers additional types available in your Wiz tenant, allowing newly introduced resource types to be ingested automatically.

Asset Category	Asset Types
AI System	AI_AGENT, AI_DATASET, AI_DEPLOYMENT, AI_EXTENSION, AI_GUARDRAIL, AI_MODEL, AI_PIPELINE, AI_SERVICE, AI_TOOL
Compute	COMPUTE_INSTANCE_CONFIGURATION, COMPUTE_INSTANCE_GROUP, SERVERLESS, SERVERLESS_PACKAGE, VIRTUAL_DESKTOP, VIRTUAL_MACHINE, VIRTUAL_MACHINE_IMAGE, VIRTUAL_WORKSPACE, VIRTUAL_WORKSTATION, WORKSTATION
Containers & Kubernetes	CONTAINER, CONTAINER_GROUP, CONTAINER_IMAGE, CONTAINER_REGISTRY, CONTAINER_REPOSITORY, CONTAINER_SERVICE, KUBERNETES_CLUSTER, MCP_SERVER, SECRET_CONTAINER
Storage	BUCKET, FILE_SYSTEM_SERVICE, HYBRID_STORAGE_SERVICE, SNAPSHOT, STORAGE_ACCOUNT, VOLUME
Database	DATABASE, DATA_CATALOG, DATA_PROCEDURE, DATA_WORKFLOW, DATA_WORKLOAD, DATASET_CONFIGURATION, DB_SERVER, MAP_REDUCE_CLUSTER, METADATA_REPOSITORY, SCHEMA_CONFIGURATION, SEARCH_INDEX
Network	API_GATEWAY, CDN, DNS_PRIVATE_RESOLVER, DNS_ZONE, FIREWALL, FIREWALL_CONFIGURATION, GATEWAY, IP_ADDRESS_GROUP, IP_ADDRESS_POOL, LOAD_BALANCER, NAT, NETWORK_APPLIANCE, NETWORK_INTERFACE, NETWORK_MANAGEMENT_SERVICE, PRIVATE_ENDPOINT, PRIVATE_LINK, PROXY, ROUTE_TABLE, SUBNET, SWITCH, TARGET_GROUP, TELECOM_NETWORK, VIRTUAL_NETWORK
Identity & Access	ACCESS_KEY, SERVICE_ACCOUNT, USER_ACCOUNT
Configuration & Secrets	CLOUD_LOG_CONFIGURATION, DATA_NETWORK_POLICY, RAW_ACCESS_POLICY, SECRET
Cloud Organization	CLOUD_ORGANIZATION, RESOURCE_GROUP, SUBSCRIPTION
Governance	GOVERNANCE_POLICY, GOVERNANCE_POLICY_GROUP
Services	ARTIFACT_REGISTRY, ARTIFACT_REPOSITORY, BACKUP_SERVICE, CALL_CENTER_SERVICE, CICD_SERVICE, COLLABORATION_WORKSPACE, COMMUNICATION_SERVICE, DEDICATED_INFRASTRUCTURE, DEVELOPMENT_SERVICE, EMAIL_SERVICE, ENCRYPTION_KEY, IO_T_DEVICE, IO_T_DEVICE_GROUP, IO_T_JOB, IO_T_ROUTING_RULE, MAILBOX, MANAGED_CERTIFICATE, MANAGED_JUMP_SERVER, MANAGEMENT_SERVICE, MEDIA_SERVICE, MESSAGING_SERVICE, MONITOR_ALERT, MONITOR_SERVICE, SERVICE_BLUEPRINT, SERVICE_CONFIGURATION, SERVICE_DISCOVERY_ENDPOINT, SERVICE_DISCOVERY_NAMESPACE, SERVICE_DISCOVERY_SERVICE, SERVICE_QUOTA, SIMULATION_SERVICE, VIRTUAL_DRIVE, WEB_SERVICE

Supported Asset Types for Vulnerabilities

Wiz vulnerabilities are only available for the following six asset types:

• VIRTUAL_MACHINE
• SERVERLESS
• DATABASE
• DB_SERVER
• CONTAINER_IMAGE
• CONTAINER

Tags

SAFE associates three tag groups with Wiz assets.

Native Wiz Tags

All key-value tags configured on cloud resources in Wiz are ingested as-is.

Auto-Generated Tags

Tag	Source
Asset Type	Resource type from Wiz
Cloud Platform	Cloud provider such as AWS, Azure, or GCP
Wiz-Zone	Availability zone
Wiz-Instance-Type	Instance type
Wiz-Region	Region
Wiz-Resource-Group	Resource group name

Network Exposure Tags

Tag	Description
Wiz-NW-Exposure-Type	Type of network exposure
Wiz-Accessible-From-Internet	Whether the asset is accessible from the internet
Wiz-Has-Admin-Privileges	Whether the asset has admin privileges
Wiz-Has-High-Privileges	Whether the asset has high privileges
Wiz-Sensitive-Data	Whether the asset has sensitive data
Wiz-Is-Ephemeral	Whether the asset is ephemeral
Wiz-Is-Managed	Whether the asset is managed
Wiz-Open-To-All-Internet	Whether the asset is open to all internet
Wiz-Password-Auth-Disabled	Whether password authentication is disabled
Wiz-NW-Exposure-Region	Network exposure region

Data Synchronization Behavior

Operation	Behavior
Initial Sync	Imports all supported data
Incremental Sync	Supported (where incremental APIs are available)
Auto Sync	Configurable (Default: 7 days)
Manual Sync	Supported

Prerequisites

Before configuring the integration, ensure:

• Wiz tenant with API access
• Wiz Service Account
• Wiz API Base URL
• Wiz OAuth Authentication URL
• Client ID
• Client Secret
• Network access to Wiz APIs

Network or IP allowlisting requirements

Ensure SAFE can reach Wiz API endpoints. Allow SAFE IPs, if required by your network policy.

Permissions

To enable the SAFE integration, create a dedicated Wiz Service Account with the required API scopes. These permissions allow SAFE to securely retrieve asset inventory, vulnerabilities, cloud posture, compliance findings, and related security metadata from your Wiz environment.

SAFE recommends granting the read:all scope for simplified configuration. Alternatively, you can assign only the individual API scopes listed below to follow the principle of least privilege.

Note

Read-only permissions are sufficient for data ingestion. The create:reports and update:reports permissions are required only if your organization intends to use report generation or report scheduling capabilities.

Wiz API permission	Why it is needed
read:resources	Fetches cloud inventory and supports asset type discovery
read:vulnerabilities	Fetches software vulnerability findings across supported assets
read:cloud_configuration_finding	Fetches cloud configuration and misconfiguration findings
read:host_configuration	Fetches host-level configuration assessments and hardening checks
read:issues	Fetches Wiz issues, toxic combinations, and framework mappings

Generate Connection Details

Get the Wiz API Base URL (API Endpoint URL)

1. Log in to your Wiz account.
2. Click the User Profile icon in the top-right corner and select User Settings.
3. From the left options menu, select Tenant. The API Endpoint URL will be displayed (e.g., https://api.REGION.app.wiz.io/graphql).
4. Copy and save the API Endpoint URL (Base URL) to use when configuring the Wiz connector in SAFE.

Environment	Domain	Example
Commercial (Standard)	app.wiz.io	https://api.us1.app.wiz.io/graphql
Gov (FedRAMP)	app.wiz.us	https://api.us1.app.wiz.us/graphql
AWS GovCloud	gov.wiz.io	https://api.us1.gov.wiz.io/graphql

Get the Wiz API Auth URL

Tenant type	Auth URL
Commercial (Cognito)	https://auth.app.wiz.io/oauth/token
Commercial (Auth0)	https://auth.wiz.io/oauth/token
Gov (FedRAMP)	https://auth.app.wiz.us/oauth/token
AWS GovCloud	https://auth.gov.wiz.io/oauth/token

Get the Client ID and Client Secret

1. Log in to your Wiz account.
2. Go to Settings > Service Accounts.
3. Click Add Service Account.
4. Enter a service account name such as SAFE Integration.
5. From the Type drop-down menu, select Custom Integration (GraphQL API).
6. Select a project to limit the scope of this service account to specific projects, or configure the account with a global scope for broader visibility.
7. In the API Scopes section, select the permissions listed here.
8. Click Add Service Account to generate and display the Client ID and Client Secret. Copy and save the values as these will no longer be visible after you leave the page.

Note

Client ID and Client Secret values will no longer be visible after you leave the page.

Configure Wiz in SAFE

1. Log in to SAFE as admin and navigate to Integrations on the left navigation
2. Click on the + icon on the top right of the page.
3. Click Wiz from the list.

4. Enter a unique Integration Name.
5. Enter the API Base URL, API Auth URL, Client ID, and Client Secret obtained from Wiz. Refer to Generate Connection Details.
6. Asset last seen days filter: Enter the maximum age (in days) of assets to be considered while ingesting data from the source. Assets not seen within this time range will be excluded.
7. Enter the Auto Sync frequency in number of days. Specify how often (in days) SAFE should automatically synchronize data from the source.
8. Select the checkboxes based on your business requirement:
   1. Ingest images only with running containers: Select this option to ingest images only with running containers.
   2. Ingest container with vulnerabilities: Select this option to fetch all running containers and associated vulnerabilities.
   3. Include vulnerabilities without related issues for low-fidelity detection methods: SAFE recommends keeping this option disabled to filter out potential noisy data. High-fidelity detection methods include OS, installed software, software installed from a service, default packages, and packages, while other methods, such as file paths and libraries, are excluded.
9. Click the Test Connection.
10. Once the connection is verified, click Save.
11. Once the integration is saved, click on Sync Now to trigger an on-demand sync.

API Details

GraphQL Endpoint	https://api.REGION.app.wiz.io/graphql
Authentication	https://auth.app.wiz.io/oauth/token

API Rate Limit

SAFE follows Wiz API rate limiting guidelines. The connector:

• Uses cursor-based pagination
• Supports page sizes up to 500 records where supported
• Automatically refreshes expired OAuth tokens
• Retries transient failures
• Automatically backs off when HTTP 429 Too Many Requests responses are received
• Resumes synchronization after interruptions without duplicating data

Field Mapping

Assets

Wiz	SAFE
graphEntity.type	Asset Types
graphEntity.providerUniqueId	Cloud Unique ID
graphEntity.properties.region (normalized with cloud platform)	Cloud Region
graphEntity.lastSeen	Last Seen
graphEntity.firstSeen	Asset First Seen In

Findings

Wiz	SAFE
detailedName (or parsed from description for OS cases)	Software Name
version (may be nulled/adjusted by parser)	Software Version
N/A (derived: parsed from description regex)	Install Path
detectionMethod	Finding Type
name	CVE IDs
firstDetectedAt	First Seen
lastDetectedAt	Last Seen

Misconfigurations and Compliance

Wiz	SAFE
rule.name	Finding Name
severity	Finding Severity
status	Status
firstSeenAt (cloud misconfigs) / firstSeen (host-config misconfigs)	First Seen
securitySubCategories.category.framework.name	Compliance Framework

Limitations

• Software Inventory Limitation
  Wiz does not provide a dedicated Software Inventory API. As a result, SAFE does not ingest a complete list of installed software from Wiz. Instead, SAFE derives software information from vulnerability findings (CVEs) returned by the Wiz APIs. Software is displayed only when it is associated with a vulnerability identified by Wiz. Assets without vulnerability findings may not display installed software, even if the software exists on the asset.

FAQs

How often does SAFE synchronize with Wiz?

SAFE supports both manual synchronization and scheduled automatic synchronization. The default Auto Sync interval is 7 days but can be customized.

Does SAFE import existing historical findings?

Yes. During the initial synchronization, SAFE imports all available supported data from Wiz.

Does SAFE support incremental synchronization?

Yes. After the initial import, SAFE retrieves only new or updated findings wherever incremental APIs are available.

What happens if the API rate limit is exceeded?

SAFE automatically waits for the retry interval provided by Wiz and resumes synchronization.

Does SAFE deduplicate assets?

Yes. SAFE correlates and deduplicates assets using unique cloud and resource identifiers.

Which cloud platforms are supported?

The integration supports all cloud platforms supported by Wiz, including AWS, Microsoft Azure, Google Cloud Platform, Kubernetes, containers, and cloud-native services.

Why doesn't SAFE display software for all assets imported from Wiz?

Wiz does not provide a dedicated Software Inventory API. SAFE derives software information from vulnerability (CVE) findings returned by the Wiz APIs. As a result, software is displayed only when it is associated with a vulnerability identified by Wiz. Assets without vulnerability findings may not display installed software, even if software is present on the asset.

Why is an asset visible in Wiz but not imported into SAFE?

SAFE imports only the assets returned by the Wiz APIs using the configured service account credentials. If an asset is visible in the Wiz UI but is not imported into SAFE, verify that the asset is included in the Wiz Project associated with the service account configured in SAFE. Assets outside the scope of the configured project or inaccessible to the service account cannot be retrieved through the Wiz APIs and therefore cannot be ingested into SAFE.

Can I limit the data imported into SAFE?

Yes. SAFE provides configuration options to:

• Import only running container images
• Import only containers with vulnerabilities
• Exclude low-fidelity vulnerability detections
• Filter assets based on the last seen date