Wiz
Purpose
Ingests Wiz issues, vulnerability findings, detection findings, and failing configuration findings into SubImage.
tip
Secret fields below accept either an AWS Secrets Manager ARN or a value pasted directly into SubImage's managed vault. See Secrets for details.
Required Fields
| Field | Secret? | Description |
|---|---|---|
wiz_graphql_url |
No | Wiz GraphQL API endpoint, copied from the Wiz tenant settings |
wiz_client_id |
No | Wiz custom integration service-account client ID |
wiz_client_secret |
Yes | Wiz custom integration service-account client secret |
Optional Fields
| Field | Secret? | Description |
|---|---|---|
wiz_auth_url |
No | OAuth token endpoint; defaults to https://auth.app.wiz.io/oauth/token |
wiz_tenant_id |
No | Stable tenant identifier when sharing a graph across multiple Wiz tenants |
wiz_project_ids |
No | Comma-separated Wiz project IDs; cleanup is skipped for filtered imports |
wiz_lookback_days |
No | Fetch only updates from the last N days; cleanup is skipped in lookback mode |
Setup Steps
- In Wiz, open Settings → Tenant → General → Access Management and add a Custom Integration service account.
- Leave project selection empty and grant the Read all entities permission.
- Copy the client ID and client secret. Wiz only displays the secret when the service account is created.
- Open
https://app.wiz.io/tenant-info/generaland copy the API endpoint URL. - In SubImage, fill in
wiz_graphql_url,wiz_client_id, andwiz_client_secret, then save the module.
Notes
- The sync is read-only.
- Complete unfiltered syncs clean up stale Wiz issues and findings; filtered and lookback syncs intentionally skip cleanup.