# Wiz URL: https://docs.clearly-ai.com/docs/integrations/security/wiz Description: Connect Wiz to Clearly AI to bring cloud security context into reviews, risk analysis, and project workflows. ## Overview [#overview] The Wiz integration imports Wiz Projects and posture findings as Clearly AI project sources. Clearly AI uses those findings as review context so teams can analyze cloud security posture, answer review templates, and identify security gaps. This is the initial Wiz integration. More finding types and workflow actions are planned. The current integration supports: * Wiz client credentials authentication. * Wiz API region and tenant class configuration. * Wiz Project discovery. * Wiz Project source creation across five finding types: **Issues**, **Cloud Configuration (CSPM)**, **Vulnerability**, **Secret**, and **IaC**. * Per-source severity and status filters. * Preview counts per finding type before saving a source. * Importing matching Wiz findings as markdown context for Clearly AI reviews and chat. ## Connect Wiz [#connect-wiz] 1. In Clearly AI, open **Organization settings**, select **Integrations**, then click **Set up** on the Wiz card. 2. Under **Authentication**, enter your Wiz **Client ID** and **Client Secret**. 3. Choose the Wiz **Region** for your tenant. The region selects the Wiz API host Clearly AI calls (`https://api..app.wiz.io/graphql`). * Preset options include common data centers such as `us1`, `us2`, `us3`, `us4`, `us8`, `us17`, `eu1`, `eu2`, `eu17`, `ap1`–`ap4`, and `gov1`. * If your data center is not listed, choose **Use custom value** and enter the region code from **Wiz → Tenant Info** (for example, `us65`). Use lowercase letters and digits only, with no hyphen or underscore (`us65`, not `US-65`). 4. Choose the **Tenant class**: * **Commercial** — token endpoint `https://auth.app.wiz.io/oauth/token` * **Gov** — token endpoint `https://auth.app.wiz.us/oauth/token` * **Gov AWS** — token endpoint `https://auth.gov.wiz.io/oauth/token` 5. Check **I understand** under the shared-credential notice, then click **Add workspace credential**. Clearly AI tests the credential and enables the integration only when the test passes. Clearly AI requests tokens with the `client_credentials` grant and the `wiz-api` audience. Your Wiz service account needs these read scopes: | Scope | Used for | | -------------------------------- | -------------------------------------------------- | | `read:projects` | List Wiz Projects available to the service account | | `read:issues` | Import Wiz Issues into Clearly AI | | `read:vulnerabilities` | Read vulnerability findings | | `read:cloud_configuration` | Read cloud configuration findings | | `read:iac_configuration_finding` | Read IaC findings | | `read:secret_instances` | Read secret findings | The Client ID and Client Secret are stored as a workspace-level secret. Use a dedicated Wiz service account rather than an individual user, and grant only the scopes listed above. ## Add Wiz findings to a project [#add-wiz-findings-to-a-project] 1. Open **Projects**. 2. Select the project you want to review. 3. Select **Manage Sources**. 4. Select **Search Integrations**. 5. Choose **Wiz**. [Image: Add Wiz Project source picker] 6. Select a **Wiz Project**. 7. Choose one or more **Finding types**: Issues, Cloud Configuration (CSPM), Vulnerability, Secret, or IaC. 8. Choose a **Severity floor**. Clearly AI imports findings at that severity or higher. Available values: `INFO`, `LOW`, `MEDIUM` (default), `HIGH`, `CRITICAL`. 9. Choose statuses, such as **Open** (default), **In progress**, **Resolved**, or **Rejected**. 10. Review **Preview counts** to confirm how many findings match your filters per finding type. 11. Select **Save Source**. ## Current supported workflows [#current-supported-workflows] ### Cloud security review context [#cloud-security-review-context] Clearly AI imports selected Wiz findings into a project so reviews can use them as evidence. Each imported finding is rendered as markdown including: * Finding ID, finding type, severity, status, and last-updated timestamp. * Affected resource (ID, name, type, and cloud platform). * Parent Wiz Projects. * Description, evidence chain (framework, category, control hierarchy for cloud configuration findings; OS / image / IP / exploit flag for vulnerabilities; source rules, service tickets, and notes for Issues). * Remediation guidance. * A deep link back to the finding in Wiz. Cloud Configuration (CSPM) findings include extra context to help the reviewer connect a finding to the rule that produced it: * **Rule** — Wiz rule short ID, service type, whether the rule is Wiz built-in or customer-authored, and any risks it mitigates. * **Cloud Context** — provider resource ID, native type, region, subscription/account name and external ID, tags, and first-seen timestamp. * **Resource-specific Remediation** — when Wiz provides node-level remediation that differs from the rule-level guidance. ### Use findings in reviews and chat [#use-findings-in-reviews-and-chat] After Wiz findings are saved as a source, Clearly AI can use them in review template reviews, compliance analysis, and project chat. ### Filtered source creation [#filtered-source-creation] Use the source picker to narrow imported findings by Wiz Project, minimum severity, and status. Preview counts show how many findings match before you save. ## Not yet supported [#not-yet-supported] * Wiz **Data** findings are visible in the source picker but cannot yet be selected. The Wiz API does not currently expose a queryable connection for data findings. * Clearly AI imports Wiz findings for analysis only. Updating, closing, or otherwise modifying findings back in Wiz is not yet available. * A single Wiz Project source imports up to the first 500 matching findings per finding type. Use narrower filters or add additional sources for larger projects. * Secret findings are filtered to the chosen Wiz Project on the Clearly AI side because the Wiz Secret API does not expose a project filter. Severity and status filters still apply directly at Wiz. ## FAQs [#faqs] Confirm the Client ID and Client Secret are correct, that the **Tenant class** matches your Wiz deployment (Commercial, Gov, or Gov AWS), and that the service account can obtain a token using the `client_credentials` grant against the matching `auth.*` host. Also confirm **Region** matches the data center in Wiz Tenant Info. Selecting the wrong region (for example `us1` when your tenant is `us65`) can return `401 Unauthorized` from the GraphQL API even when credentials are valid. Choose **Use custom value** and enter the region code from Wiz Tenant Info in lowercase without hyphens (for example, enter `us65` if Tenant Info shows `US-65`). Clearly AI builds the GraphQL host as `https://api..app.wiz.io/graphql`. Confirm the service account has the `read:projects` scope and that the configured **Region** matches the Wiz API region where your projects live. Wiz requires the `read:iac_configuration_finding` scope for IaC queries. Update your Wiz service account to include this scope, then disable and re-enable the integration in Clearly AI so the new permission is recognized. A single Wiz Project source caps at the first 500 matching findings per finding type. Tighten the severity floor or status filters, or split coverage into multiple sources. ## Related [#related] * [Reviews](https://docs.clearly-ai.com/docs/reviews) * [Chat](https://docs.clearly-ai.com/docs/chat) * [Integrations](https://docs.clearly-ai.com/docs/integrations)