Wiz is a cloud security platform that detects and remediates misconfigurations from build time to runtime across hybrid cloud environments. Wiz leverages native cloud APIs and services to provide a comprehensive view of an organization’s cloud footprint, identifying vulnerabilities and threats in real time.
The Balbix integration with Wiz ingests cloud infrastructure assets, associated vulnerabilities, software entities, and operational/business information configured by your IT and cybersecurity teams.
How Balbix processes Wiz data
Balbix uses AI to aggregate, normalize, and deduplicate the ingested data from Wiz, along with information from your existing IT and cybersecurity tools. This creates a unified view of your entire asset inventory, including vulnerabilities and their operational and business context.
Balbix’s AI models analyze this data to deliver insights such as:
Deployment gap analysis: Identify areas lacking security coverage.
Risk-based vulnerability prioritization: Provide detailed ranking and scoring of vulnerabilities based on risk.
Risk quantification: Assess risk at the asset, group, or enterprise level.
This comprehensive approach enables more informed and effective security decisions, allowing you to proactively manage risk across your organization.
Integration summary
This table provides a summary of the Balbix integration for the Wiz connector.
Integration type | Fetch: An inbound API integration used to retrieve assets and their related metadata, such as tags. |
Types of assets fetched | Cloud resources. |
Types of data fetched | Asset names, interface information (MAC address, IP address), OS information, associated tags, software details, vulnerabilities, and relevant timestamps (e.g., first observed, last observed), controls. |
Prerequisites
To set up the Balbix connector, you must first create Wiz API credentials with the necessary permissions. These credentials are required to complete the configuration process.
Steps to create Wiz API credentials:
Get the Wiz API URL: Log in to Wiz and retrieve the API endpoint URL.
Get the client ID and secret: Create a service account in Wiz to obtain the Client ID and Client Secret.
Get the Wiz API URL
To retrieve the Wiz API URL:
Log in to your Wiz account.
Click the User Profile icon in the top-right corner and select User Settings.
From the left options menu, select Tenant. The API Endpoint URL will be displayed (e.g.,
https://api.<region>.app.wiz.io/graphql).Copy and save the API URL to use when configuring the Wiz connector in Balbix.
Get the client ID and client secret
To obtain the client ID and client secret, add a service account in Wiz:
Log in to your Wiz account.
Go to Settings > Service Accounts.
Click Add Service Account.
Enter a service account name such as Balbix Integration.
From the Type drop-down menu, select Custom Integration (GraphQL API)
Select a project to limit the scope of this service account to specific projects, or configure the account with a global scope for broader visibility.
In the API Scopes section, select the following permissions:
read:all or read:resources
create:reports
update:reports
Click Add Service Account to generate and display the client ID and client secret.
Copy the client ID and client secret, and securely save them for later use when setting up the Wiz connector in Balbix.
Caution: Be sure to copy and save the client secret—it will no longer be visible after you leave the page.
Set up your Wiz connector
After completing the prerequisites, follow these steps to configure your Balbix connector for Wiz.
Step 1: Select the connector
Start by selecting a connector using the steps outlined below:
Go to Data Sources from the left navigation bar.
In the Connectors table, click + Add Connector.
Click Select a Connector to Configure to expand the window and view the list of available connectors.
Click the + icon on the Wiz tile.
Step 2: Configure the connector
Configure the connector using the steps outlined below.
Configuration Notes
Ingest images only with running container: Select this option to ingest images only with running containers.
Ingest container with vulnerabilities: Select this option to fetch al running containers and associated vulnerabilities
Include vulnerabilities without related issues for low-fidelity detection methods: Balbix recommends keeping this option disabled to filter out potential noisy data. High-fidelity detection methods include OS, installed software, installed software from service, default package, and package, while other methods such as file path and libraries are excluded.
Asset last seen days filter: Add the number of days you want to consider since the asset was last seen. See “Understanding First Seen and Last Seen”.
Rate limits
The rate limit for the Wiz REST API is assumed to be as documented on the Wiz API documentation page. The limit is set to 50 requests per minute for most endpoints, with some endpoints having a limit of 10 requests per minute.
Caution: If the rate limits are exceeded, an "HTTP 429 Too Many Requests" error will occur. Balbix automatically manages rate limits by pausing and retrying API calls after the designated wait time.
If you have a large number of cloud assets and notice that the Wiz connector is taking an extended time to retrieve details, rate limit issues may be the cause. For assistance with unusually long retrieval times, reach out to support@balbix.com.
API reference documentation
To learn more about the Wiz API, see the references listed below: