Wiz (Cloud Security) Connector

Have the following ready before starting the connector configuration:

1. Ensure you have access to the Wiz portal with permissions to create service accounts.
2. Create a service account in Wiz with the Project Admin role and configure it as a Custom Integration – GraphQL type. Note the Client ID and Client Secret immediately upon creation.
3. Obtain your Tenant Data Center from the Wiz portal: click the User icon, select Tenant Info, and note the Data Center and Regions values. You will need these to construct your API endpoint URL.
4. Contact your Technical Account Manager (TAM) or Qualys Support to activate the connector for your subscription.

Permissions Required

The Wiz service account must have the following minimum permissions:

• read:vulnerabilities — Required to retrieve vulnerability findings.
• read:resources — Required to retrieve asset data.

The built-in Project Admin role in Wiz provides both of these permissions. If you prefer to use a custom role, ensure both permissions are explicitly granted.

This step establishes the connector's identity and authenticates it with Wiz.

1. Log in to Qualys ETM.
2. Navigate to Connectors > Integration.
3. Locate the Wiz (Cloud Security) Connector on the Connector Marketplace and click Add. This is a one-time task.

   Note: If the connector is already added, navigate to My Connectors, search for the Wiz (Cloud Security) connector, and click Manage Connections.

4. From the connector tile, click Manage Connections.
5. Click Create Connection. The Setup Guide opens, displaying the Before You Begin checklist alongside four reference tabs: Overview, Auth Setup, Permissions, and Troubleshooting. Review these before proceeding.
6. Click Proceed to Setup.
7. On the Profile & Connectivity page, complete the following fields:

   Connector Details

   Field	Description
   Name (required)	A unique display name for this connector connection.
   Description	An optional description of the connection's purpose.

   Authentication Details

   Provide the following values to authenticate the connector with your Wiz environment.

   Field	Type	Description
   Token URL (required)	String	The OAuth 2.0 token endpoint for your Wiz environment. Example: https://auth.app.wiz.io/oauth/token
   API Endpoint URL (required)	String	Your Wiz GraphQL API endpoint. Follows the format https://api.<TENANT_DATA_CENTER>.<ENVIRONMENT>. Example: https://api.us17.app.wiz.io/
   Client ID (required)	String	The Client ID from the Wiz service account created with the Custom Integration – GraphQL type.
   Client Secret (required)	Encrypted String	The Client Secret from the Wiz service account. Copy this immediately upon service account creation — it is not shown again.

   Finding your API Endpoint URL: In the Wiz portal, click the User icon and select Tenant Info. Use the Data Center and Region values to construct the URL in the format above.

   

8. Click Test Connection. A modal will appear showing the status of five sequential checks:
   • Network Reachability — Verifies that the connector endpoint is reachable over HTTPS (port 443).
   • TLS Handshake — Confirms that a secure TLS connection can be established with the remote endpoint.
   • Authentication Credential Check — Validates the configured credentials against the source system's authentication endpoint.
   • Authorization Scope Check — Confirms that the provided credentials have the required permissions to access the configured data scope.
   • Data Fetch — Verifies that data can be successfully retrieved from the source system using the configured connection.
   • 

   Important: All five checks must pass before you can proceed. If the Authentication Credential Check fails with an Unauthorized error, verify that the Client ID, Client Secret, and Token URL are correct, and that the service account has not been disabled or revoked in Wiz.

9. Click OK to dismiss the test result modal, then click Next.

This step defines what data is ingested and when the connector runs.

1. Data to Sync — Select one of the following options:
   • Assets & Findings — Ingests both asset records and associated vulnerability and misconfiguration findings (recommended).
   • Assets — Ingests asset records only, without findings.
2. Advanced Settings (optional) — Click Advanced Settings to open a panel where you can further refine what is ingested. See Advanced Settings below.
3. Schedule — Under the Schedule section, select an execution frequency from the Occurs dropdown (for example, Daily). The system will display the calculated start date, end date, and timezone for the scheduled run.

   Note: The schedule timezone is determined by your Qualys account settings. The connector will run from the configured start date for a default period of 5 years.

4. Click Next to proceed to the final step.

Step 3: Review & Confirm