Wiz (Cloud Security) Connector

 The Asset / Misconfiguration column indicates whether the connector imports both asset inventory and misconfiguration findings (Both) or misconfiguration findings only.

✓ = Supported.     
 — = Not Supported.
NA = Vendor does not support this.
The Resource Type row shows the specific cloud service targeted for each asset class.

"—" entries indicate the asset class/finding type combination is not yet available for this connector. NA indicates that CNAPP vendor is currently not supporting this asset class/finding type combination.

Have the following ready before starting the connector configuration:

1. Ensure you have access to the Wiz portal with permissions to create service accounts.
2. Create a service account in Wiz with the Project Admin role and configure it as a Custom Integration – GraphQL type. Note the Client ID and Client Secret immediately upon creation.
3. Obtain your Tenant Data Center from the Wiz portal: click the User icon, select Tenant Info, and note the Data Center and Regions values. You will need these to construct your API endpoint URL.
4. Contact your Technical Account Manager (TAM) or Qualys Support to activate the connector for your subscription.

Permissions Required

The Wiz service account must have the following minimum permissions:

• read:vulnerabilities — Required to retrieve vulnerability findings.
• read:resources — Required to retrieve asset data.

• read:cloud_configuration — Required to retrieve misconfiguration data.

• read:inventory — Required to retrieve inventory data.

These permissions are required for the connector to run successfully and for the authorization scope validation to succeed during the Test connection step.

Key rotation - When rotating credentials, regenerate the Client Secret in the Wiz service account settings. Then update the credentials in Qualys ETM using the Edit Connector option.

This step establishes the connector's identity and authenticates it with Wiz.

1. Log in to Qualys ETM and navigate to Connectors > Integration.
2. Locate the Wiz (Cloud Security) Connector on the Connector Marketplace and click Add. This is a one-time task.

   If the connector is already added, navigate to My Connectors, search for the Wiz (Cloud Security) connector, and click Manage Connections.

3. Click Manage Connections from the connector tile.
4. Click Create Connection. The Setup Guide opens, displaying the Before You Begin checklist alongside four reference tabs: Overview, Auth Setup, Permissions, and Troubleshooting. Review these before proceeding.
5. Click Proceed to Setup.
6. On the Profile & Connectivity page, complete the following fields:

   Connector Details

   Field	Description
   Name (required)	A unique display name for this connector connection.
   Description	An optional description of the connection's purpose.

   Authentication Details

   Provide the following values to authenticate the connector with your Wiz environment.

   Field	Type	Description
   Token URL (required)	String	The OAuth 2.0 token endpoint for your Wiz environment. Example: https://auth.app.wiz.io/oauth/token
   API Endpoint URL (required)	String	Your Wiz GraphQL API endpoint. Follows the format https://api.<TENANT_DATA_CENTER>.<ENVIRONMENT>. Example: https://api.us17.app.wiz.io/
   Client ID (required)	String	The Client ID from the Wiz service account created with the Custom Integration – GraphQL type.
   Client Secret (required)	Encrypted String	The Client Secret from the Wiz service account. Copy this immediately upon service account creation — it is not shown again.

   Finding your API Endpoint URL: In the Wiz portal, click the User icon and select Tenant Info. Use the Data Center and Region values to construct the URL in the format above.

   

7. Click Test Connection. A modal will appear showing the status of five sequential checks:
   • Network Reachability — Verifies that the connector endpoint is reachable over HTTPS (port 443).
   • TLS Handshake — Confirms that a secure TLS connection can be established with the remote endpoint.
   • Authentication Credential Check — Validates the configured credentials against the source system's authentication endpoint.
   • Authorization Scope Check — Confirms that the provided credentials have the required permissions to access the configured data scope.
   • Data Fetch — Verifies that data can be successfully retrieved from the source system using the configured connection.
     
     

   All five checks must pass before you can proceed. If the Authentication Credential Check fails with an Unauthorized error, verify that the Client ID, Client Secret, and Token URL are correct, and that the service account has not been disabled or revoked in Wiz.

8. Click OK and then click Next.

This step defines what data is ingested and when the connector runs.

1. Data to Sync — Select one of the following options:
   • Assets & Findings — Ingests both asset records and associated vulnerability and misconfiguration findings (recommended).
   • Assets — Ingests asset records only, without findings.

The Info icon identifies the default selections for Asset Types and Findings used in data mapping. To change these selections, go to Advanced Settings > Filters, and then configure Asset Types and Filters as needed.

2. Advanced Settings (optional) — Turn on the Advanced Settings toggle to select the asset classes and finding types that you want to ingest into ETM.
3. Schedule — Under the Schedule section, select an execution frequency from the Occurs dropdown (for example, Daily). The system will display the calculated start date, end date, and timezone for the scheduled run. The schedule configuration supports recurring synchronization, such as Daily.
   

The schedule timezone is determined by your Qualys account settings. The connector will run from the configured start date for a default period of 5 years.

4. Click Next.

Advanced Settings

Enabling the Advanced Settings toggle on the Scope & Schedule page or clicking the Advanced Settings link opens a panel with two tabs: Filters and Transform Map.

Filters Tab

Use the Filters tab to restrict which asset types and findings are ingested.

Click Save once the changes are saved in the Advanced Settings panel. Closing without saving discards any modifications.

Transform Map 

The Transform Map tab displays the default field mappings from Wiz source fields to Qualys ETM target fields for each asset class. These mappings are predefined by Qualys and applied automatically during connector execution. 

Review all configured settings before creating the connection and then click Create.

The new connection is displayed in the Connections list with a Registered state and an Active status.