Wiz

Overview
How to connect
Automated checks
Useful links

DSALTA connects to Wiz using read-only API access to collect compliance evidence automatically. Data feeds into your Data Library modules.

Read-only access. DSALTA never modifies, creates, or deletes resources in your Wiz environment.

DSALTA collects this integration’s data when you connect it — you can refresh it at any time with Sync from integrations on the Integrations page. The compliance checks below re-run once a day at 02:00 America/New_York.

What DSALTA reads

DSALTA reads cloud vulnerability findings, which appear on your Vulnerabilities page — the first 100 findings your tenant returns for the vulnerabilityFindings query, with no paging beyond that. Each finding is recorded with the status Open whatever its state in Wiz, and its DSALTA severity is derived from the Wiz severity label, with the Wiz score kept as the CVSS score. This integration does not collect a user roster.It calls these Wiz endpoints:

GraphQL POST tenant apiUrl (default https://api.us1.app.wiz.io/graphql), op query VulnerabilityFindings($first: Int) { vulnerabilityFindings(first: $first) {…} }
token https://auth.app.wiz.io/oauth/token

Every request is a read. DSALTA has no code path that creates, modifies, or deletes anything in your Wiz environment.

Troubleshooting

Integration shows Disconnected

There is no Reconnect button. Open Integrations → Connected, click Manage on the Wiz card, and check the Status tab — it shows either Connected and working properly or Connection issues detected. To restore a broken connection you must Disconnect and connect again, which permanently deletes the data and tests collected from Wiz. This usually happens when the Wiz service account is deleted, its client secret is rotated, or its scopes are reduced — DSALTA mints a fresh token from the client credentials on every request, so an expiring access token is never the cause.

Data is not syncing

Verify the connected account still holds the permissions this integration requires. Then open Integrations in the DSALTA sidebar, stay on the Connected tab, and click Sync from integrations at the top right. That button refreshes every connected integration at once — there is no per-integration sync control.

Create a Wiz service account and paste its client_id, client_secret and GraphQL API URL.You will need:

Field	Where to find it	Example
Client ID	See the steps below	—
Client secret	See the steps below	—
GraphQL API URL	See the steps below	`https://api.us1.app.wiz.io/graphql`

Start in DSALTA

Open Integrations in the DSALTA sidebar, find Wiz, and click Connect to open the connect panel. Leave it open — it lists every value you need, and you create those in the steps below.

Integrating Wiz means

DSALTA will read your Wiz vulnerability findings. Read-only.

Create a service account

In Wiz: Settings → Service Accounts → Add Service Account. Choose the service-account type for custom GraphQL API integrations (not a cloud-connector type) and give it the read:vulnerabilities scope — that is the only scope DSALTA needs. Copy the Client ID and Client Secret (the secret is shown once), then copy your tenant’s GraphQL endpoint, which looks like https://api.<region>.app.wiz.io/graphql.

Enter your credentials

Paste the Client ID, Client Secret and GraphQL API URL, then click Connect.

Only the GraphQL API URL is configurable. DSALTA always exchanges your client ID and secret at https://auth.app.wiz.io/oauth/token with audience wiz-api, so the service account must be one that authenticates there. If your tenant issues service-account credentials against a different token endpoint, the connection will fail validation no matter how the GraphQL URL is set.

DSALTA validates the credential when you click Connect. On success the integration moves to the Connected tab, and Manage → Status reads Connected and working properly. Checks begin reporting after the first sync.

If the connection is rejected. Invalid credentials or wrong GraphQL API URL.The on-screen message is generic — see Connection error messages.

This check does not currently run. The Wiz integration collects vulnerability findings only — it does not execute automated compliance checks, and it does not read the Wiz user roster the check below would need. The check is defined but produces no result while this is the case. Use the Vulnerabilities page for the evidence this integration does provide.

The check below is defined for Wiz but is not currently executed. Click it for step-by-step remediation guidance.

Check	Severity	What it verifies
User access to Critical System should be valid	Info	Checks that users with access to critical systems are authorized in Wiz.

Topic	Link
General	Wiz website
DSALTA	Connection error messages

Getting Connected

Identity Providers

Cloud Infrastructure

Code Repositories

Security & Monitoring

Databases

SaaS & Productivity

What DSALTA reads

Troubleshooting

​What DSALTA reads

​Troubleshooting

What DSALTA reads

Troubleshooting