Wiz — Integration Setup

Prerequisites

• Wiz tenant with cloud accounts already onboarded
• Ability to create a Wiz Service Account
• CMDash Essentials tier or above

Step 1: Create a Wiz Service Account

1. In the Wiz console, go to Settings → Access Management → Service Accounts → Add Service Account and choose the Custom Integration (GraphQL API) type.
2. Name it CMDash Integration and grant it a read-only scope covering Issues and Vulnerability Findings (read:issues, read:vulnerabilities).
3. Copy the generated Client ID and Client Secret. Wiz shows the secret only once.

CMDash exchanges that client ID and secret for a short-lived access token itself, on every sync (OAuth 2.0 client credentials, audience=wiz-api; the token is cached until shortly before it expires). Nothing needs refreshing by hand and the connection runs unattended.

Step 2: Connect in CMDash

1. Navigate to Integrations in your CMDash dashboard.
2. Find Wiz and click Connect.
3. Enter:
   • API key: the service account's Client Secret
   • Service account client ID: the Client ID
   • Wiz authentication endpoint: Wiz (auth.app.wiz.io) for most tenants, or Wiz for Government (auth.gov.wiz.io). Check the Authentication URL under Settings → Tenant Info if unsure.
   • Wiz API endpoint: defaults to https://api.us20.app.wiz.io/graphql; override with your tenant's GraphQL URL (shown under Settings → Tenant Info)
4. Click Save & Test Connection.

The client secret is stored encrypted, like every other CMDash credential, and is only ever sent to Wiz's token endpoint.

Older connections: a connection made before this change holds a pasted access token and no client ID. It keeps working as it did (and still expires within hours). Edit the connection, enter the Client ID and put the Client Secret in the API key field, and it becomes self-renewing.

What Syncs

Both queries follow Wiz's GraphQL cursor (pageInfo.endCursor) page by page, 500 records per request, up to 20 pages (10,000 records) per collection. If a collection is larger than that, or a later page cannot be read, the sync is recorded as partial with a warning saying which collection is incomplete; it is never shown as a clean success. Issues are filtered to OPEN/IN_PROGRESS status; vulnerability findings are filtered to OPEN status. Wiz's CVSS severity, exploitability score, and CISA KEV flag are captured on each vulnerability finding.

Troubleshooting

• Token exchange failed (HTTP 401): The Client ID or Client Secret is wrong, or the service account was disabled or deleted. Re-enter both. If it only fails for a gov tenant, check the Wiz authentication endpoint setting.
• 403 Forbidden: The service account's scope doesn't include read access to Issues or Vulnerability Findings.
• Connecting to the wrong tenant/region: Confirm the API Endpoint matches your Wiz tenant's actual GraphQL URL — CMDash defaults to api.us20.app.wiz.io, which is only correct for some Wiz regions.
• Sync fails intermittently every hour or so: This only happens on a connection that still holds a pasted access token (no Client ID). See "Older connections" above.

Rate Limits & Sync Behavior

Credential Rotation

Rotate the service account's Client Secret in Wiz on your normal schedule. There is no token to refresh.

To rotate:

1. In Wiz, generate a new secret for the service account (or create a new service account).
2. In CMDash: Settings → Integrations → Wiz → Edit.
3. Enter the new API key (the Client Secret) and, for a new service account, its Client ID, then Save.

Multiple Instances / Multi-Site

If you operate more than one Wiz tenant (e.g., separate tenants per business unit), each needs its own CMDash connection.

To add another tenant:

1. Create a service account and obtain a token in the additional tenant, following Step 1.
2. In CMDash: Settings → Integrations → Add Integration → Wiz.
3. Enter the access token and API endpoint for the additional tenant.
4. Give the connection a descriptive name (e.g., Wiz - Corp, Wiz - Subsidiary).
5. Click Save & Test Connection.

Compliance Framework Coverage

The Wiz integration provides evidence for the following controls. Coverage is automatically mapped when data is synced.