Wiz (VM Assets) Connector

Complete the following prerequisites before configuring the connector. Have the values below ready before proceeding to setup.

1. Ensure you have a Wiz account with the Project Admin role or equivalent permissions to create service accounts.
2. Create a service account in Wiz with the type set to Custom Integration (GraphQL) and the required API scopes. (See Locate and Create Wiz Service Account Credentials below.)
3. Identify your Wiz API Endpoint URL and Token URL. The API Endpoint URL follows the format https://api.<TENANT_DATA_CENTER>.<ENVIRONMENT>, and the Token URL depends on your tenant type.
4. Confirm network connectivity: Qualys cloud must be able to reach your Wiz API endpoint over HTTPS (port 443).

Locate and Create Wiz Service Account Credentials

Locate Your Wiz Tenant Data Center

1. Log in to Wiz. Click the user icon in the top-right corner of the interface, then select Tenant Info.
2. Note the Data Center and Regions value. This determines the regional component of your API Endpoint URL (for example, us1, us2, or eu1).

Identify Your API Endpoint URL and Token URL

The API Endpoint URL follows the format https://api.<TENANT_DATA_CENTER>.<ENVIRONMENT>. Use the table below to determine the correct environment value and Token URL for your tenant type.

Create a Service Account

1. Log in to Wiz with the Project Admin role.
2. Navigate to Settings > Service Accounts (or Settings > Access Management > Service Accounts, depending on your Wiz version).
3. Click Add Service Account.
4. Enter a descriptive name for the service account.
5. Set the type to Custom Integration (GraphQL).
6. Select the projects the service account should have access to, or leave the selection empty to allow access to all projects.
7. In the API Scopes section, select the following scopes:
   1. read:resources – required for host asset ingestion.
   2. read:vulnerabilities – required for vulnerability findings ingestion.
8. Click Add Service Account.
9. The page displays a Client ID and Client Secret. Copy and store these values securely.

Permissions Required

The Wiz service account must be of type Custom Integration (GraphQL) with the read:resources and read:vulnerabilities API scopes. The account that creates the service account must have the Project Admin role or equivalent in Wiz.

Scope and Data Access

The connector supports GraphQL query-based filtering to scope which data is imported. Example filter formats include filtering by asset ID or by vendor severity, status, and detection method. These filters are configured during the profile setup step in Qualys ETM.

Key Rotation

When rotating the Client Secret, create a new service account in Wiz or regenerate the credentials for the existing one. Update the Qualys ETM connector configuration with the new Client ID and Client Secret values. Verify the connector reaches the Processed state after the next scheduled execution. Remove unused service accounts from Wiz as a security practice.

Connector Details

Provide a name and description to identify this connector, and select the asset and findings types to ingest.

Authentication Details

Provide the OAuth 2.0 credentials obtained from your Wiz service account. These values are used to request an access token before each GraphQL query.

After entering all credentials, click Test Connection to validate connectivity. The following checks are performed:

• Network Reachability — Verifies that the connector endpoint is reachable over HTTPS (port 443).
• TLS Handshake — Confirms that a secure TLS connection can be established with the remote endpoint.
• Authentication Credential Check — Validates the configured credentials against the source system's authentication endpoint.
• Authorization Scope Check — Confirms that the provided credentials have the required permissions to access the configured data scope.
• Data Fetch — Verifies that data can be successfully retrieved from the source system using the configured connection.

Select the data types to synchronize and configure the execution schedule for this connector.

1. Under Data to Sync, select one or both of the following:
   1. Assets – ingests Host Asset records including cloud resource metadata.
   2. Vulnerabilities – ingests associated vulnerability findings when asset ingestion is enabled.
2. Select the required Transform Map for data mapping (see Transformation Maps).
3. Optionally, enter a Filter query to scope which records are retrieved. The filter field uses GraphQL query syntax. Sample filters:
   • By asset ID: {"assetId": ["xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"]}
   • By severity, status, and detection method: {"vendorSeverity": ["LOW"],"status": ["OPEN"],"detectionMethod": ["PACKAGE"]}
4. Set the connector Status to Active or Inactive.
5. Configure the Schedule:
   1. Single Occurrence – provide an exact date and time for a one-time execution.
   2. Recurring – provide a start date/time and end date/time for repeating executions.

Sampling Mode - Limit Sync to Top 1,000 Assets and Findings

Sampling Mode can restrict data ingestion to a targeted subset of up to 1,000 assets and their associated findings. You can quickly validate integration and review meaningful security data without a full environment sync.

You can select the Limit sync to top 1,000 assets and findings checkbox to limit the fetch 1000 assets using risk-based filter criteria. The assets, along with their associated findings, are discovered and shared with ETM. The connector applies risk-based filters during asset fetch to ensure the ingested subset represents the most relevant assets in your environment rather than a random or arbitrary sample.
The connector limits asset fetch to Virtual Machine resource types only. All findings associated with the fetched virtual machines are ingested alongside the asset data.

Click next to review your changes and create the connector.