Wiz

This document provides step-by-step instructions for integrating Wiz with AiStrike, enabling data synchronization, vulnerability monitoring, and security issue management.◼︎

1. Prerequisites

Access to a Wiz tenant with permissions to create service accounts (e.g., Global Admin role).

Additionally, please provide a read-only AiStrike service account named aistrike_svc for reviewing and testing integration. Please share the authentication details for the aistrike_svc account at the time of setup to aid with testing.

Required Wiz API scopes:

• Audit: admin:audit

• Issues: read:issues

• Vulnerability: read:vulnerabilities

• Cloud Configuration Finding: read:cloud_configuration

2. Required Wiz Connection Details

Token URL:

• Amazon Cognito: https://auth.app.wiz.io/oauth/token

• Query URL (API Endpoint URL)

• Client ID

• Client Secret

• Project IDs (Optional)

How to Obtain API Endpoint URL:

• Log in to Wiz.

• Click the User Profile icon and go to User Settings.

• Click Tenant from the left menu.

• Copy and save the API Endpoint URL for use in AiStrike.

OR

The Wiz GraphQL API has a single endpoint:

https://api.<TENANT_DATA_CENTER>.app.wiz.io/graphql

where <TENANT_DATA_CENTER> is the Wiz regional data center in which your tenant resides, e.g., us1, us2, eu1, or eu2. The endpoint remains the same for all API operations.

To retrieve your GraphQL endpoint:

• In the upper-right corner of your Wiz console, click the user icon > User settings.

• On the left side, click Tenant.

• Copy your API Endpoint URL and store it in a secure location.

How to Obtain Client ID & Client Secret:

• Log in to Wiz with an Admin role.

• Navigate to Go to Settings > Access Management > Service Accounts.

• If a read-only service account does not exist, create a new one named aistrike_svc:

  • Click Add Service Account.

  • Fill out the form:

    • Name: aistrike_svc

    • Type: Custom Integration (GraphQL API)

    • Projects: Select appropriate projects (Optional)

    • API Scopes:

      • Select read:resources.

      • ✅ read:issues

      • ✅ read:vulnerabilities

      • ✅ read:cloud_configuration

      • ✅ admin:audit

  • Click Add Service Account.

  • Store the Client ID and Client Secret in a secure location.

3.1 Push-Based Integration Using Webhooks [Recommended]

Wiz supports webhook-based integration for sending security alerts and event notifications to AiStrike.

Prerequisites:

• User with sufficient permissions to generate webhook URLs on the third-party product.

• Write access to Settings > Response and Automation in Wiz.

• Global roles can create integrations applicable across all projects, whereas project-scoped roles can only configure them for assigned projects.

Webhook Integration Steps:

Step 1: Webhook URL and API from AiStrike

• Obtain the webhook URL from AiStrike.

• (Optional) Generate authentication credentials (username/password or authentication token).

• Copy and save the URL and credentials for later use.

Step 2: Configure Webhook in Wiz

• In Wiz, navigate to Settings > Integrations.

• Click Add Integration.

• Under SIEM & Automation Tools, select Webhook.

• In the New Integration setup:

  • Enter a meaningful Name.

  • Define the Project Scope (Global or Project-specific).

  • Paste the Webhook URL.

  • (Optional) Click Add Header and enter any custom headers.

  • Select the Authentication Method:

    • None (Not recommended).

    • Basic Authentication (Enter Username & Password).

    • Token Authentication (Enter Bearer Token).

    • Client Certificate (For additional security, enter CA and/or Client Certificate).

  • Click Add Integration.

Note: Wiz Support cannot generate the webhook URL or authentication token. Refer to the third-party documentation for details.

3.2 Wiz Connection Details for API Pull

4. Wiz API Limits

• Audit Logs: 10,000 results

• Cloud Configuration Findings: 10,000 results

• Issues: No limit

• Vulnerabilities: No limit