Wiz Vulnerabilities Connector

The following is not supported in Tenable FedRAMP Moderate environments. For more information, see the Tenable FedRAMP Product Offering.

Wiz scans every layer of cloud environments without agents to provide complete visibility into every technology running in the client's cloud without blind spots. Wiz connects via API to AWS, Azure, GCP, OCI, Alibaba Cloud, VMware vSphere, Openshift, and Kubernetes across virtual machines, containers, and serverless.

Connector Details

Prerequisites and User Permissions

Before you begin configuring the connector, make sure you have the following:

• Wiz API Server URL, e.g. https://win.wiz.io/reference/prerequisites#api-endpoint-url.

• One of the following Wiz Auth URLs:

  • Wiz Commercial: https ://auth.app.wiz.io/oauth/token

  • Wiz for Gov (FedRAMP): https ://auth.app.wiz.us/oauth/token

  • Wiz Commercial hosted on AWS GovCloud: https ://auth.gov.wiz.io/oauth/token

• A user with access to all of the Wiz Project if all projects are to be fetched. Otherwise, a user with access to the relevant projects is required.

  

• Set up the Wiz Service Account

Set up the Wiz Service Account

To set up the Wiz Service account:

1. Sign in to your Wiz instance.

2. Navigate to Settings > Integrations > Vulcan integration.

   Note: The integration is still labeled Vulcan in Wiz. Wiz is in the process of updating this label to TenableOne.

3. On the integration page, create a new service account. The required permissions are preconfigured.

4. Click Create.

5. Once created, Wiz will display the access key (Client ID) and secret (Client Secret).

6. Copy both values and save them in a secure location.

   You'll be required to enter the credentials in the appropriate fields in the connector set up page in Exposure Management.

Add a Connector

To add a new connector:

1. In the left navigation menu, click Connectors.

   The Connectors page appears.

   

2. In the upper-right corner, click Add new connector.

   The Connector Library appears.

   

3. In the search box, type the name of the connector.

4. On the tile for the connector, click Connect.

   The connector configuration options appear.

Configure the Connector

To configure the connector:

1. (Optional) In the Connector's Name text box, type a descriptive name for the connector.

2. In the Server Url and Auth Url text boxes, paste the Wiz server and authentication URLs for your Wiz account.

3. In the Client ID and Client Secret text boxes, paste the client credentials you generated in Wiz.

4. In the Data pulling configuration section, you can configure dynamic settings specific to the connector.

   • In the Fetch selected Wiz projects text box, type the Wiz project ID from which you want to fetch data. Leave this box blank if you want to fetch data from all of your available Wiz projects.

   • In the Asset Retention text box, type the number of days after which you want assets to be removed from Tenable Exposure Management. If an asset has not been detected or updated within the specified number of days, it is automatically removed from the application, ensuring your asset inventory is current and relevant.

     Tip: For more information, see Asset Retention.

   • (Optional) From the drop-down menu, you can choose to automatically remove assets that reach a certain asset status, for example, Inactive (selected by default).

5. In the Test connectivity section, click the Test Connectivity button to verify that Tenable Exposure Management can connect to your connector instance.
   

   • A successful connectivity test confirms that the platform can connect to the connector instance. It does not, however, guarantee that the synchronization process will succeed, as additional syncing or processing issues may arise.
     

   • If the connectivity test fails, an error message with details about the issue appears. Click Show tests for more information about the exact error.
     

     

6. In the Connector scheduling section, configure the time and day(s) on which you want connector syncs to occur.

   Tip: For more information, see Connector Scheduling

7. Click Create. Tenable Exposure Management begins syncing the connector. The sync can take some time to complete.
   

8. To confirm the sync is complete, do the following:

   • Navigate to the Connectors page and monitor the connector's status. Sync is complete once the connector status is Connected.

   • View the sync logs for the connector to monitor the logs for a successful connection.

Wiz Vulnerabilities in Tenable Exposure Management

Locate Connector Assets in Tenable Exposure Management

As the connector discovers assets, Tenable Exposure Management ingests those devices for reporting.

To view assets by connector:

1. In Tenable Exposure Management, navigate to the Assets page.

2. In the Filters section, under 3rd Party Connectors, click the connector name for which you want to view assets.

   

   The asset list updates to show only assets from the selected connector.

3. Click on any asset to view Asset Details.

Locate Connector Weaknesses in Tenable Exposure Management

As the connector discovers weaknesses, Tenable Exposure Management ingests those weaknesses for reporting.

To view weaknesses by connector: 

1. In Tenable Exposure Management, navigate to the Weaknesses page.

2. In the Filters section, under 3rd Party Connectors, click the connector name for which you want to view weaknesses.

   

   The weaknesses list updates to show only weaknesses from the selected connector.

3. Click on any weakness to view Weakness Details.

Locate Connector Findings in Tenable Exposure Management

As the connector discovers individual findings, Tenable Exposure Management ingests those findings for reporting.

To view findings by connector:

1. In Tenable Exposure Management, navigate to the Findings page.

2. In the Filters section, under 3rd Party Connectors, click the connector name for which you want to view findings

   

   The findings list updates to show only assets from the selected connector.

3. Click on any asset to view Finding Details.

Data Mapping

Exposure Management integrates with the connector via API to retrieve relevant weakness and asset data, which is then mapped into the Exposure Management system. The following tables outline how fields and their values are mapped from the connector to Exposure Management.

Device Mapping

Tenable Exposure Management UI Field	Wiz Vulnerabilities Field
Unique Identifier	Name + Provider ID + cloudProviderURL+ subscriptionExternalId
Asset - External Identifier or Asset - Provider Identifier	Provider ID or External ID
Asset - Name	Name
Asset - Operating Systems	operatingSystem
Asset - IPv4 Adresses Asset - IPv6 Adresses	ipAddresses
Asset - MAC Addresses	network_interfaces.MacAddress
Asset - First Observation Date	creationDate
Asset - Last Observed At	last Seen
Asset - External Tags	Tags project cloud_platform Region Subscription Subscription ID image_source Wide Internet Exposure Image Name isPublic isEphemeral
Asset Custom Attributes	os_version Projects Cloud Platform Region Subscription Subscription ID Resource Type Native Type Provider ID External ID ImageId PublicDnsName Role FunctionArn kind cloudProviderURL runtime status

Device Findings Mapping

Tenable Exposure Management UI Field	Wiz Vulnerabilities Field
Unique Identifier	Asset unique + Vuln unique+Finding ID
Finding Name	Name
CVEs	Name
Severity Driver	Score
Description	CVEDescription
Finding Custom Attributes	CVSSSeverity FixedVersion Link Finding Type: “Vulnerabilities" DetailedName Version Description ExploitabilityScore ImpactScore HasExploit FindingStatus VendorSeverity LocationPath FixedVersion HasCisaKevExploit DetectionMethod Projects WizURL
First Seen	FirstDetected
Last seen (Observed)	LastDetected

Container Mapping

Tenable Exposure Management UI Field	Wiz Vulnerabilities Field
Unique Identifier	Name + Provider ID + cloudProviderURL+ subscriptionExternalId
Asset - Name	Name
Asset - First Observation Date	creationDate
Asset - Last Observed At	last Seen
Asset - External Tags	Tags project cloud_platform Region Subscription Subscription ID image_source Wide Internet Exposure Image Name isPublic isEphemeral
Asset Custom Attributes	operatingSystem Images repoExternalId digest Projects Cloud Platform Region Subscription Subscription ID Resource Type Native Type Provider ID External ID ImageId PublicDnsName Role FunctionArn kind cloudProviderURL runtime status

Container Findings Mapping

Tenable Exposure Management UI Field	Wiz Vulnerabilities Field
Unique Identifier	Asset unique + Vuln unique+Finding ID
Finding Name	Name
CVEs	Name
Severity Driver	Score
Description	CVEDescription
Finding Custom Attributes	component_id : DetailedName: Version + package_type:DetectionMethod CVSSSeverity FixedVersion Link Finding Type: “Vulnerabilities" DetailedName Version Description ExploitabilityScore ImpactScore HasExploit FindingStatus VendorSeverity LocationPath FixedVersion HasCisaKevExploit DetectionMethod Projects WizURL
First Seen	FirstDetected
Last seen (Observed)	LastDetected

Other Mapping

Wiz Cloud Resources are mapped to "Other" in the Exposure Management UI.

Tenable Exposure Management UI Field	Wiz Vulnerabilities Field
Unique Identifier	Name + Provider ID + cloudProviderURL+ subscriptionExternalId
Asset - Name	Name
Provider Names	Cloud Platform
Cloud Resource Type	Native Type
Asset - First Observation Date	creationDate
Asset - Last Observed At	last Seen
Asset - External Tags	Tags project cloud_platform Region Subscription Subscription ID image_source Wide Internet Exposure Image Name isPublic isEphemeral
Asset Custom Attributes	Projects Cloud Platform Region Subscription Subscription ID Resource Type Native Type Provider ID External ID ImageId PublicDnsName Role FunctionArn kind cloudProviderURL runtime status

Other Findings Mapping

Tenable Exposure Management UI Field	Wiz Vulnerabilities Field
Unique Identifier	Asset unique + Vuln unique+Finding ID
Finding Name	Name
CVEs	Name
Severity Driver	Score
Description	CVEDescription
Finding Custom Attributes	CVSSSeverity FixedVersion Link Finding Type: “Vulnerabilities" DetailedName Version Description ExploitabilityScore ImpactScore HasExploit FindingStatus VendorSeverity LocationPath FixedVersion HasCisaKevExploit DetectionMethod Projects WizURL
First Seen	FirstDetected
Last seen (Observed)	LastDetected

Finding Status Mapping

Note:For Wiz Vulnerabilities, Exposure Management uses the FindingStatus in Full fetch and status in delta fetch.

Finding Severity Mapping

Note:For Wiz Vulnerabilities, Tenable uses the Score field to determine severity.

Status Update Mechanisms

Every day, Tenable Exposure Management syncs with the vendor's platform to receive updates on existing findings and assets and to retrieve new ones (if any were added).

The table below describes how the status update mechanism works in the connector for findings and assets ingested into Tenable Exposure Management.

Uniqueness Criteria

Tenable Exposure Management uses defined uniqueness criteria to determine whether an ingested asset or finding should be recognized as a distinct record. These criteria help define how assets and findings are identified and counted from each connector.

Tip:  Read all about Third-Party Data Deduplication in Tenable Exposure Management

The uniqueness criteria for this connector are as follows:

API Endpoints in Use

Support Limitations and Expected Behavior

This section outlines any irregularities, expected behaviors, or limitations related to integration of the connector and Exposure Management. It also highlights details about ingested and non-ingested data to clarify data handling and functionality within this integration.

Data Validation

This section shows how to validate and compare data between Tenable Exposure Management and the Wiz Vulnerabilities platform.

IMPORTANT! Wiz data is updated frequently, which can make validation challenging. To ensure accurate comparison, include only data that aligns with the last successful sync timestamp, supported asset types, and relevant asset or finding statuses. Applying consistent filters helps maintain validation accuracy. For more info, see Support and Limitations.

Asset Data Validation

Wiz assets are synced using Inventory Reports. For each sync, the connector triggers the Wiz API to generate a report named Tenable Inventory Report - {{ project_id }}. The project_id corresponds to the ID provided in the connector configuration. If no ID is provided, * is used as the default value.

Objective: Ensure the number of assets in Wiz aligns with the number of devices displayed in Tenable Exposure Management.

In Wiz:

1. Navigate to the Reports section.

2. Locate the generated report titled Tenable Inventory Report - {{ project_id }}.

3. Confirm the relevant timeframe by matching the data to the timestamp of the last successful sync.

4. Filter out unsupported asset types and archived assets in Wiz.
   The Wiz connector only supports the following asset types: Virtual Machine, Serverless, Container, and Container Image.

5. Download the report and count the number of rows. Each row represents a single asset.

In Tenable Exposure Management:

1. Locate your connector assets.

2. Compare the total number of assets between Wiz and Tenable Exposure Management.

Expected outcome: The total numbers returned in Wiz and Exposure Management should match.

If an asset is not visible in Exposure Management, check the following conditions:

• The asset's status changed to one of the selected statuses defined in the Asset Retention configuration (Inactive by default)

• Archived based on the last observed date (field Last Seen)

  Tip: To learn more on how assets and findings change status, see Wiz Vulnerabilities Connector.

Finding Data Validation

Findings data is ingested through Wiz Vulnerabilities Reports. During full syncs, the connector creates reports titled Tenable Vulnerabilities Report - {{ asset_type }}, where asset_type refers to one of the supported asset types listed above.

Objective: Ensure the number of findings in Wiz aligns with the number of findings in Tenable Exposure Management.

In Wiz:

1. In the Wiz platform, navigate to the Reports section.

2. Locate the relevant Tenable Vulnerabilities Report - {{ asset_type }} files for each supported asset type.

3. Download each report and count the number of rows. Each row represents a finding.

In Tenable Exposure Management:

1. Locate your connector findings.

2. Compare the total number of findings between Wiz Vulnerabilities and Tenable Exposure Management.

Expected outcome: The total numbers returned in Wiz Vulnerabilities and Exposure Management should match.

If a finding is missing from Exposure Management or no longer active, check the following conditions:

• The finding is marked as Fixed and appears under the Fixed state on the Findings screen

• The finding no longer appears because its related asset was archived.

  Tip: To learn more on how assets and findings are archived or change status, see Wiz Vulnerabilities Connector.