> For the complete documentation index, see [llms.txt](https://docs.sprinto.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.sprinto.com/integrations/overview/wiz-integration-code-and-cloud.md). # Wiz Integration (Code & Cloud) Learn how to integrate Wiz with Sprinto to automatically import vulnerability findings from your cloud environment and codebase, track remediation against SLAs, and collect audit-ready evidence for vulnerability management controls. Wiz is a cloud security platform that scans your cloud infrastructure, workloads, and source code to surface security risks such as misconfigurations, exposed secrets, insecure dependencies, and exploitable vulnerabilities. **Sprinto supports two Wiz vulnerability sources:** * **Wiz Cloud** – imports cloud and workload vulnerability findings (CSPM / cloud vulnerability management). * **Wiz Code** – imports code and application-layer vulnerability findings (SAST, software composition analysis, secrets, IaC). Integrating Wiz with Sprinto allows Sprinto to continuously pull these findings and evaluate them against your vulnerability-management controls, so that detected vulnerabilities are tracked and resolved within your defined Service Level Agreement (SLA). {% hint style="warning" %} **Beta** The Wiz Code and Wiz Cloud vulnerability integrations are currently in Beta and are enabled on request. If you do not see Wiz listed as a vulnerability source in your account, contact [Sprinto Support](mailto:support@sprinto.com) to have it enabled. ![](https://3220032727-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FEsyn5VMU6e0OyGjRtKgx%2Fuploads%2FZY74io6JDgFbpxKbTCIe%2Fimage.png?alt=media\&token=80b07e43-bbbf-4184-ba24-ea02e91609eb) {% endhint %} {% hint style="info" %} **Note** Sprinto takes read-only access through this integration and does not read or store your source code. The access granted is used only to retrieve vulnerability findings and metadata required to compute compliance checks. {% endhint %} #### Sprinto checks for Wiz Below are the available Sprinto checks for the Wiz vulnerability sources: | **Sprinto check** | **Reference procedure** | | ----------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Wiz Cloud vulnerability alert should be resolved within SLA | [How to fix](https://docs.sprinto.com/monitors/vulnerability-and-security-monitors/how-to-resolve-sprinto-check-for-resolving-vulnerability-within-the-sla#step-2-filter-for-vulnerability-checks) | | Wiz Code vulnerability alert should be resolved within SLA | [How to fix](https://docs.sprinto.com/monitors/vulnerability-and-security-monitors/how-to-resolve-sprinto-check-for-resolving-vulnerability-within-the-sla#step-2-filter-for-vulnerability-checks) | These checks activate when Sprinto detects an open vulnerability on your connected Wiz account. To fix a check, resolve (or dismiss, where justified) the finding at the source in Wiz — the check passes automatically on the next sync once the finding is no longer open. ### How It Works Wiz is connected to Sprinto through **Leen**, Sprinto's security-integration aggregator. Leen brokers the authenticated connection to the Wiz API on Sprinto's behalf, so you authorise once and Sprinto pulls findings on a recurring schedule. For more on how Sprinto handles data through aggregators, see [Trust and Data Handling in Integration Aggregators](https://docs.sprinto.com/integrations/trust-and-data-handling-in-integration-aggregators). #### What Sprinto imports * **Wiz Cloud** — vulnerability and security findings detected across your connected cloud accounts and workloads in Wiz. * **Wiz Code** — vulnerability findings detected across your repositories and application code in Wiz (dependencies, secrets, IaC, and code issues). For each finding, Sprinto imports the metadata needed for compliance tracking — identifier, title, severity, affected asset/resource, status, and detection/resolution timestamps. Source code is never accessed or stored. #### Vulnerability Monitoring * Imports open vulnerability findings from Wiz Cloud and Wiz Code. * Maps each finding to your vulnerability-management controls. * Tracks remediation timelines against your configured SLA by severity. * Automatically closes the corresponding Sprinto task once a finding is resolved at the source. #### Sync Behaviour * The initial sync typically completes within 15–20 minutes of connecting. * Sprinto may take a few hours to finish evaluating the synced data and activate the relevant checks. * Thereafter, Wiz vulnerability data syncs periodically (typically every 6–12 hours). #### Connection Type * Wiz Cloud and Wiz Code are pull-based integrations — Sprinto retrieves data from Wiz using the credentials you provide. There is no agent or pipeline job to install. ### Permissions and Data Access Sprinto connects to Wiz using a Wiz Service Account with OAuth 2.0 client credentials. #### Permissions Required Create a Service Account in Wiz with read-only scopes sufficient to retrieve findings, at a minimum: * read:issues – read security issues/findings. * read:vulnerabilities – read vulnerability data. * read:reports – read reports (and create:reports if your configuration generates reports via the Wiz API). #### Data Collected Sprinto only collects metadata required for compliance: * Vulnerability and issue findings (identifier, title, description). * Severity and status. * Affected asset, resource, or repository reference. * Detection and resolution timestamps. Sprinto does not access or store your source code. All data is transmitted securely over HTTPS, and credentials are encrypted at rest. ### Prerequisites Before connecting Wiz to Sprinto, ensure: * You are logged in to Sprinto as an **administrator**. * You have administrator access to your **Wiz tenant** and can create **Service Accounts** in Wiz. * The Wiz integration (Beta) is enabled on your Sprinto account — contact [Sprinto Support](mailto:support@sprinto.com) if it is not yet visible. * You know your **Wiz API endpoint / region** (for example, ). This can be confirmed under **Tenant Info** or **User Settings** in Wiz.
## How to Integrate Wiz with Sprinto {% stepper %} {% step %} ### Generate Wiz Service Account credentials 1. Log in to your **Wiz portal**. 2. Navigate to **Settings > Access Management > Service Accounts**. 3. **Click Add Service Account.** 4. Provide a name — for example, *Sprinto Vulnerability Integration*. 5. Assign the required read scopes (read:issues, read:vulnerabilities, read:reports). 6. **Click Add Service Account.** 7. Immediately copy and securely store the: * **Client ID** * **Client Secret** (shown only once) 8. Note your **Wiz API endpoint URL** (region-specific). {% hint style="warning" %} **Important** The Client Secret is shown only once at creation. Copy it before closing the dialog. If it is lost, you will need to regenerate the secret and reconnect in Sprinto. {% endhint %} {% endstep %} {% step %} ### Connect Wiz in Sprinto 1. Log in to the Sprinto dashboard. 2. **Navigate to Data Library > Vulnerabilities.** 3. **Click Add Vulnerability Source** (or **Set up monitoring source**). 4. Select the Wiz source you want to connect — **Wiz Cloud** or **Wiz Code**. 5. **Review the supported checks, permissions, and data used by Sprinto, then click Next.** {% hint style="info" %} **Note** Wiz Cloud and Wiz Code are configured as separate sources. If you use both, connect each one individually. You can use the same Wiz Service Account credentials for both, provided the scopes cover the findings you want to import. {% endhint %} {% endstep %} {% step %} ### Authorize and complete the connection 1. On the setup screen, enter your Wiz connection details: * **Client ID** * **Client Secret** * **API Endpoint URL / Region** (often pre-filled with the default regional endpoint) 2. **Click Connect.** Once validated, the integration is marked as Connected and the credential status displays as Active. {% endstep %} {% endstepper %}
## Post-Connection Configuration After connecting, Sprinto begins importing findings and activating checks. #### Initial Sync * Initial sync typically completes within 15–20 minutes. * Sprinto may take a few hours to evaluate the synced data and activate the relevant checks. #### Configure the Vulnerability SLA * Go to **Data Library > Vulnerabilities** and configure your **SLA by severity** (for example, Critical within 7 days, High within 30 days). * The "resolved within SLA" checks evaluate Wiz findings against these timelines. * See [How to resolve Sprinto check for resolving vulnerability within the SLA](/monitors/vulnerability-and-security-monitors/how-to-resolve-sprinto-check-for-resolving-vulnerability-within-the-sla.md). #### Review Imported Findings 1. **Navigate to Data Library > Vulnerabilities.** 2. Click **Wiz Cloud** or **Wiz Code** to review imported findings and the status of each Sprinto check. #### Resolving and Dismissing Findings * **Resolve at the source:** fix the vulnerability in Wiz. On the next sync, the finding closes in Sprinto and the task passes automatically. * **Not applicable:** if a finding does not apply to your scope, mark it as a **special case** in Sprinto with a justification. See [Mark Vulnerabilities as Special Cases](/data-library/vulnerabilities/dashboard-actions/mark-vulnerabilities-as-special-cases.md). ## Troubleshooting #### Connection or credential shows as inactive * Verify that the **Client ID** and **Client Secret** were copied correctly and the secret was not regenerated after creation. * Confirm the **API endpoint** matches your Wiz region. * Confirm the Service Account still exists and retains the required scopes. #### No findings appear after connecting * Allow the full initial sync and evaluation window (up to a few hours). * Confirm the Service Account has all required read scopes. * Verify that Wiz is actually reporting open findings for the connected scope (cloud accounts for Wiz Cloud, repositories for Wiz Code). #### API authentication errors (e.g. 401) * The credentials have expired or been revoked in Wiz. Regenerate the **Client Secret** in Wiz and reconnect the source in Sprinto. * Re-confirm the regional API endpoint. #### A resolved vulnerability still shows as open in Sprinto * Confirm the finding is closed/resolved at the source in Wiz. * Wait for the next sync cycle — the check updates automatically once Wiz reports the finding as no longer open. ### Support Please contact [Sprinto Support](mailto:support@sprinto.com) if you have any queries related to the integration or need any assistance. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.sprinto.com/integrations/overview/wiz-integration-code-and-cloud.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.