> ## Documentation Index
> Fetch the complete documentation index at: https://zeropath.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Wiz Integration

> Upload scanner results to Wiz and leverage exposure-based dynamic tagging

## Overview

ZeroPath's Wiz integration enables you to upload scanner results directly to your Wiz dashboard and view exposure information in the Explorer and Application tabs. This integration is currently in **early access**.

<Warning>
  **Wiz UVM Required**: To upload scanner results to Wiz, you must have Wiz
  Universal Vulnerability Management (UVM) enabled. Wiz code is required for UVM
  functionality.
</Warning>

## Prerequisites

Before setting up the Wiz integration, ensure you have:

* Wiz UVM enabled in your Wiz account
* The necessary Wiz API permissions (see [Required Permissions](#3-required-permissions))
* Access to your Wiz dashboard settings

### Enabling Wiz UVM

If Wiz UVM is not already enabled on your account:

1. Navigate to your Wiz dashboard
2. Go to **Settings → Preview & Migration Hub**
3. Enable **Universal Vulnerability Management (UVM)**

## Setup Instructions

### 1. Create the Integration in Wiz

Create the integration credentials using the dedicated ZeroPath tile in Wiz — do not create credentials through a service account.

1. Navigate to [https://app.wiz.io/settings/deployments/integrations/new/zero-path](https://app.wiz.io/settings/deployments/integrations/new/zero-path)
2. Follow the prompts to complete the integration setup and generate your credentials

### 2. Configure the Integration in ZeroPath

1. Navigate to [https://zeropath.com/app/settings/integrations](https://zeropath.com/app/settings/integrations)

2. Click **Add Integration**

3. Select **Wiz** from the list of available integrations

4. Fill out the configuration fields:

   **Required Fields:**

   * **Client ID**: Your Wiz service account client ID
   * **GraphQL URL**: Your Wiz GraphQL API endpoint (e.g., `https://api.us17.app.wiz.io/graphql`)
   * **Client Secret**: Your Wiz service account client secret

   **Optional Fields:**

   * **Token URL**: OAuth token endpoint (defaults to `https://auth.app.wiz.io/oauth/token`)
   * **Wiz Project IDs**: Limit the integration to specific Wiz projects by entering project IDs separated by commas or new lines. Leave blank to include all projects.
   * **Enable Finding Export**: Toggle to enable uploading ZeroPath findings to Wiz (enabled by default)
   * **Export scope**: All finding categories export by default. SAST findings (ZeroPath's LLM-discovered code vulnerabilities) always export while the toggle above is on; IaC, secrets, and SCA findings each have a per-category switch if you prefer to rely on Wiz's native scanners for them

5. Click **Save** to complete the integration setup

### 3. Required Permissions

Your Wiz API credentials must have the following permissions:

```
read:resources
read:projects
read:network_exposure
create:external_data_ingestion
read:system_activities
read:sast_findings
read:iac_configuration_finding
read:vulnerabilities
```

These permissions allow ZeroPath to:

* Upload scanner results to Wiz (`create:external_data_ingestion`)
* Read exposure and configuration data (`read:resources`, `read:projects`, `read:network_exposure`)
* Enrich Wiz findings you already track instead of duplicating them — reads what Wiz has
  (`read:sast_findings` for SAST, `read:iac_configuration_finding` for IaC, `read:vulnerabilities`
  for SCA) and comments ZeroPath's analysis on the matching Wiz finding. All three are **optional**:
  SAST and IaC enrichment require both code-finding read scopes; without either, both categories
  export as new records. SCA enrichment independently requires `read:vulnerabilities`.
  Posting the enrichment comment itself needs no additional write scope.

## Features

### Scanner Results Upload

Once configured, ZeroPath automatically uploads scanner results to your Wiz Unified Vulnerability Management (UVM) dashboard after each full scan. All finding categories export by default; each category other than SAST can be switched off per organization in the integration settings.

**Enrichment instead of duplicates**: before exporting, ZeroPath queries Wiz for findings your Wiz-native scanners already track on the same repository — SCA by CVE + package + version (requires `read:vulnerabilities`), SAST by weakness + file + line (requires `read:sast_findings`), and IaC by file + line (requires `read:iac_configuration_finding`). When a ZeroPath finding matches one Wiz already tracks, ZeroPath does not add a second copy and does not overwrite Wiz's finding — it posts a comment on Wiz's finding with ZeroPath's severity, validation verdict, and a link to the patch and full analysis. When a finding has not been assessed by any ZeroPath validator, the enrichment comment explicitly states this and clarifies that the severity shown is a pre-validation estimate, not a confirmation of exploitability. Findings Wiz does not have are exported as new. This keeps one enriched record per fact. Enrichment is controlled by the **Enrich Wiz findings** toggle (on by default) and no-ops without a Wiz read scope; in that case exports proceed as normal.

For SAST, IaC, and secrets exports, a finding a ZeroPath agent has assessed carries the composite rating the dashboard shows for it, and findings rated informational on that composite are not exported. A finding no agent was able to assess is always exported, because ZeroPath lists it as open and queued for human review and omitting it would resolve it in Wiz; it carries ZeroPath's pre-validation severity estimate for the detected vulnerability class — and its description states that ZeroPath has not assessed it, since no confidence was ever measured to combine with that severity. SCA exports carry CVSS-based severity ratings. When all findings in a category have been resolved, enriched into Wiz-native findings, or otherwise removed, ZeroPath sends an empty replacement to the corresponding Wiz data source to resolve any previously exported copies, keeping your Wiz dashboard free of stale ZeroPath findings. The uploaded results will be visible in your Wiz UVM interface, allowing you to view and manage findings alongside your other Wiz security data.

### Exposure Information in ZeroPath

The integration pulls exposure information from Wiz and displays it in ZeroPath's Application view (accessible from the scan explorer — see [Check Exposure Data](#check-exposure-data-in-zeropath) below). You can see which applications have internet exposure based on Wiz's network analysis, along with direct links to the Wiz dashboard and exposed URIs.

### Runtime Evidence in Issue Details

When the Wiz integration is connected, each finding's detail view and API response includes runtime evidence showing which cloud workloads are deployed from the finding's repository — including running status, sensitive data handling, internet reachability, and attribution. Two snapshots are provided: the state at the time the finding was detected and the latest lookup. See [Exposure Information](/docs/integrations/wiz-exposure#runtime-evidence-in-issue-details) for details.

### Dynamic Tagging Based on Exposure

Create tags that automatically apply to repositories when internet exposure is detected by Wiz.

#### Setting Up Dynamic Tags

1. Go to [Settings → Repository tags](https://zeropath.com/app/settings/tags)
2. Click **Create Tag**
3. Enter a tag name and optional description
4. Under **Dynamic Tag Triggers**, select **Internet exposure**
5. Optionally select specific repositories or add custom property filters
6. Click **Create Tag**

Repositories with internet exposure detected through Wiz will automatically receive this tag.

## AI Assistant & MCP Server Access

When the Wiz integration is configured, the ZeroPath AI security assistant (and the ZeroPath MCP server) can query your Wiz tenant in real time using the following read-only tools:

* **Get Wiz Settings** — View your organization's Wiz integration configuration, including which Wiz project IDs are enrolled and whether SAST enrichment is enabled. The Wiz client secret is never exposed.
* **List Wiz Projects** — List all Wiz projects visible to your configured credentials. Useful for verifying project access or discovering projects not yet enrolled in ZeroPath.
* **Search Wiz Assets** — Search for cloud resources in Wiz by name fragment (e.g., `payments-api`, `redis-prod`). Results are scoped to your enrolled Wiz project IDs. Up to 50 results can be returned per query.
* **Search Wiz Exposures** — Find live network exposure findings in Wiz by entity name. Defaults to `PUBLIC_INTERNET` exposures. This search runs across your entire Wiz tenant because the Wiz API does not support project-scoped filters on network exposures.

These tools are read-only — the AI assistant cannot modify your Wiz integration credentials or settings. You can use them to answer questions like "What cloud assets match this service?" or "Is this host exposed to the internet?" directly from the assistant or any MCP-compatible client.

<Info>
  The Wiz API tools require the same permissions as the main integration. Ensure
  your credentials have `read:resources`, `read:projects`, and
  `read:network_exposure` permissions.
</Info>

## Verifying the Integration

After setting up the Wiz integration, you can verify it's working correctly by checking the following:

### Check SAST Results in Wiz

If **Enable Finding Export to Wiz** is turned on:

1. Run a full scan on a repository in ZeroPath
2. After the scan completes, navigate to your Wiz UVM dashboard
3. Look for the uploaded findings from ZeroPath in your SAST results
4. Findings will appear alongside your other Wiz security data

<Note>
  SAST results are uploaded automatically after a full scan completes. Allow a
  few minutes for results to appear in Wiz.
</Note>

### Check Exposure Data in ZeroPath

If the integration is pulling exposure data correctly:

1. Go to [https://zeropath.com/app/scans](https://zeropath.com/app/scans) and open a completed scan
2. In the scan explorer's left-hand tree, click on an **Application** node that is deployed and exposed to the internet
3. In the Application panel on the right, look for:
   * **Wiz Dashboard Link**: A clickable link labeled "Open Wiz Dashboard" that opens your Wiz tenant dashboard in a new tab
   * **Exposed URIs**: A list of publicly accessible endpoints detected by Wiz

If you see the Wiz Dashboard link and exposed URIs for your internet-facing applications, the exposure data sync is working.

<Note>
  The "Open Wiz Dashboard" link opens the Wiz tenant dashboard for your
  organization. From there, you can search for the specific resource within Wiz.
</Note>

### Check Integration Status

1. Go to [https://zeropath.com/app/settings/integrations](https://zeropath.com/app/settings/integrations)
2. Select the **Wiz** integration from the sidebar to open its detail panel
3. Verify your configured Project IDs and settings are displayed correctly

### View Wiz Sync Progress

To view detailed information about the current Wiz sync progress:

1. Navigate to [https://zeropath.com/app/scans](https://zeropath.com/app/scans)
2. Click on the scan time to open the scan logs
3. The logs will show the status of the Wiz integration, including upload progress and any errors

## Troubleshooting

### Scanner Results Not Appearing in Wiz

* **Verify finding export is enabled**: In your integration settings, ensure the "Enable Finding Export to Wiz" toggle is turned on
* **Verify UVM is enabled**: Confirm that Wiz UVM is active in your Wiz dashboard under Settings → Preview & Migration Hub
* **Check API permissions**: Ensure your Wiz API credentials have all required permissions, especially `create:external_data_ingestion` and `read:system_activities`
* **Run a full scan**: SAST results are only uploaded after full scans complete, not PR scans
* **Wait for processing**: Allow a few minutes for results to appear in Wiz after the scan completes

### ZeroPath Findings Duplicate Wiz Findings Instead of Enriching Them

If a repository shows both a Wiz-native finding and a separate ZeroPath copy of the same issue,
enrichment is not running. It fails open by design — the export still succeeds, so nothing else
looks wrong.

* **Check the read scopes**: enrichment needs `read:sast_findings` (SAST),
  `read:iac_configuration_finding` (IaC), and `read:vulnerabilities` (SCA). These are separate from
  the scopes that upload findings, so an integration can export perfectly while enriching nothing.
  SAST and IaC require both code-finding read scopes; SCA uses its own scope independently.
* **Confirm the toggle**: the **Enrich Wiz findings** toggle in your integration settings must be on
  (it is on by default).
* **Read the scan logs**: open the scan at [https://zeropath.com/app/scans](https://zeropath.com/app/scans)
  and look for `dedup index unavailable`. A message naming
  `access denied, at least one of the following is required: [read:all read:sast_findings]` (or
  `read:iac_configuration_finding` or `read:vulnerabilities`) indicates a missing scope.
  It is logged on every export until the scope is granted.

### Exposure Data Not Appearing in ZeroPath

* **Verify deployment files exist**: ZeroPath detects exposures by analyzing deployment configuration files (Kubernetes YAML, Docker Compose, Helm charts) in your repository
* **Check API permissions**: Ensure your credentials have `read:network_exposure`, `read:resources`, and `read:projects` permissions
* **Verify resources in Wiz**: The resources defined in your deployment files must exist in your Wiz inventory
* **Check Project IDs**: If you specified Wiz Project IDs, ensure your resources are in those projects

### Dynamic Tags Not Applying

* **Confirm exposure data sync**: Verify that exposure information is being synced from Wiz (check the Application view for Wiz exposure data)
* **Check tag configuration**: Ensure the Internet exposure trigger is selected in your tag settings at [Settings → Repository tags](https://zeropath.com/app/settings/tags)
* **Check permissions**: Ensure your Wiz credentials have `read:resources` and `read:projects` permissions


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.