Wiz

Wiz is a comprehensive cloud security platform that provides agentless visibility, threat detection, and security posture management across multi-cloud and hybrid environments. It enables organizations to identify and remediate security risks, misconfigurations, vulnerabilities, and compliance violations across their entire cloud infrastructure including AWS, Azure, Google Cloud Platform, and other cloud providers.

Category	Vulnerability management
Direction	Query source
Sign-in	Service Account
Query languages	SQLite
Tables	12
Query templates	62
Website	wiz.io

Before you start

Huntbase signs in to Wiz with Service Account. Create the credential in Wiz first, then keep it to hand for the Connect step.

1. In the Wiz console, go to Settings › Access Management › Service Accounts and click Add Service Account.
2. Enter a Name and, for Type, select Custom Integration (GraphQL API). Optionally, limit the account to specific Projects.
3. Grant the read:all scope.
4. Create the service account and copy the Client ID and Client Secret.
5. Copy your API Endpoint URL from your tenant information in User Settings › Tenant.

Permissions:

• read:all

Watch out for

• Each connection covers a single Wiz tenant.

For the vendor's own instructions, see Wiz Service Accounts page (sign-in required).

tip

Use a dedicated, read-only credential for Huntbase where the product allows it. Huntbase only needs to read.

Connect Wiz

1. Go to Connections and click New connection, or click New connection on the Wiz product page.
2. On Product, pick Wiz and choose the Owner.
3. On Details, give the connection a Name and, optionally, a Description.
4. On Connect, fill in the settings and credentials described below.
5. On Verify, review the summary and click Create & check.

For everything else on the setup page — saving a draft, I'll do this later, and what each check result means — see Connections.

Settings

Where your Wiz lives:

Field	Required	Notes
Client ID	Yes
Wiz API Endpoint	Yes	The full GraphQL endpoint, which varies by region, such as https://api.us1.app.wiz.io/graphql. Add /graphql to the API Endpoint URL that Wiz shows.

Credentials

The only Method is Service Account. Enter a Credential label (for example Production), then fill in:

Field	Required	Notes
Client Secret	Yes	Secret — not shown again after you save it.

Query it

Once connected, Wiz can serve these languages in a query tab, and Scout can use it when you ask in Auto:

Language	Use it for
SQLite	SQL over the 12 tables listed below, alongside every other connected source.

Example: SQLite

List all security categories — Returns basic information about all security categories, including their names, IDs, framework associations, and descriptions.

select
  name,
  id,
  framework_id,
  description
from
  wiz_security_category;

Wiz ships with 62 query templates. Find them in Library › Queries — see Query templates.

What syncs automatically

Wiz comes with a content pack. These queries run on a schedule on each new connection so the entities they find appear in the Activity Feed without you asking. You can turn syncing off from the connection's Synchronisation Settings card.

Query	Finds
Sync users	user
Sync global administrators	user
Sync service accounts	account, programmatic credential
Sync admin roles	group
Sync suspended users	organization, user

Tables

Wiz adds 12 tables. Browse their columns from Schema in the query bar's ⋯ menu.

All 12 tables

Table	Contains
wiz_cloud_config_rule	Wiz Cloud Configuration Rule
wiz_cloud_configuration_finding	Wiz Cloud Configuration Finding
wiz_control	Wiz Control
wiz_issue	Wiz Issue
wiz_project	Wiz Project
wiz_security_category	Wiz Security Category
wiz_security_framework	Wiz Security Framework
wiz_service_account	Wiz Service Account
wiz_subscription	Wiz Subscription
wiz_user	Wiz User
wiz_user_role	Wiz User Role
wiz_vulnerability_finding	Wiz Vulnerability Finding

Next steps

• Connections — health, credentials and settings after you connect
• Query languages — syntax, parameters and time ranges
• Chatting with Scout — ask questions without writing a query
• All integrations — the rest of the catalog