Wiz

Wiz is a unified cloud security that enables prevention, active detection and response. Wiz is used by security and development teams to reduce risk, gain unmatched visibility, prioritize risk and enabling business agility.  

Integration Method: API

Tables: Assessment Finding (99402001), Data Security Finding (2006), Detection Finding (2004), Device Inventory (5001), Scan Activity (6007), Vulnerability Finding (2002)

The integration supports the following events.

This integration supports the following versions.

Note:

Wiz doesn’t follow a traditional versioning system. As of this document preparation, the latest release was on February 24, 2025.

Prerequisites

• The user should have access to Wiz portal with an account that has Admin privilege.

• The user should have access to the DataBee console.

Configuration Overview

1. Generate an API Key and Client Secret with the required scopes.

2. Add the Wiz data feed in the DataBee console with the below parameters.

Wiz Configuration

1. Login to Wiz platform.

2. Navigate to Settings > Access Management > Service Accounts.
    

3. Click Add Service Account.
    

4. Enter ‘Name’ and ‘Description’ of service account and select the ‘Type’ as Custom Integration (GraphQL API).
    

5. Under API Scopes, the following permissions need to be granted to fetch all the events. DataBee requires read permissions.

   Event Type	Permission
   Vulnerability Finding	read:vulnerabilities
   Cloud Configuration	read:cloud_configuration
   Network Exposure	read:network_exposure
   Issues	read:issues
   System Activity	read:system_activities
   Host Configuration Finding	read:host_configuration
   External Attack Surface	read:endpoint_attack_surfaces
   Data Finding	read:data_findings

   
   
   
   
   
   
   
   

6. Click on Save.

7. Copy the secret credentials as they will only be shown once.
    

Wiz API URL

1. To get the API tenant, go to Tenant Info.

   

2. Copy the API Endpoint URL (without /graphql) and Authentication URL info. This will be used when configuring DataBee data feed.
    

   Note:

   Do not copy /graphql from the API Endpoint URL.

DataBee Configuration

To configure the data feed,

1. Login to the DataBee UI, navigate to Data > Data Feeds and click the Add New Data Feed button.
    
   

2. Search for the Wiz data feed and click it as shown below.
    

3. Click on the API Ingest option for collection method.
    

4. Enter feed contact information and click Next.
    

5. In the configuration page, confirm the following:

   • API Base URL: paste the API Endpoint URL from the Wiz console.

   • Authorization Method: TokenURLAuth

   • Key Id: paste the Client ID generated earlier in the instance.

   • Secret Key: paste the Client Secret generated earlier in the instance.

   • Token URL: paste the Authentication URL from the Wiz console.

   • Event Types: preselected for all the event types that integration pulls.
      

6. Click Submit.

Troubleshooting Tips

• Ensure the Client ID and Client Secret are pasted correctly. Since you cannot view the secrets after the 1^st time, re-create the secret, paste it on a text editor to ensure no spaces or unexpected characters are included and reconfigure the DataBee feed.

• Ensure the Wiz scopes/permissions are correct.