Wiz Vulnerability Management (beta)
Connect Nebulock Helix to Wiz for just-in-time asset enrichment.
The Wiz integration enables Nebulock Helix to query cloud vulnerability exposure data from your Wiz tenant on demand, during hunts and investigations.
Prerequisites
- Access to the Wiz console with a user that has Write (W) permission on service accounts. Project-scoped roles can create service accounts only on their own projects.
- The API Endpoint URL for your Wiz tenant.
Create a dedicated Wiz service account
Log in to your Wiz console and go to Settings > Access Management > Service Accounts, then select Add Service Account.
- Enter a meaningful Name for the account, e.g. "Nebulock Helix".
- Set Type to Custom Integration (GraphQL API).
- (Optional) Limit access to specific projects (up to 50). If unsure, leave this empty.
- (Optional) Set an expiration date. We recommend leaving this empty.
- Set the API Scopes per the table below.
- Select Add Service Account.
The secret credentials dialog shows the newly created Client ID and Client Secret — copy both to a secure place, then select Finish.
Note:Wiz only displays the Client Secret once. If it's lost, you'll need to rotate the service account's credentials.
Required scopes
Grant all scopes below. Wiz checks scopes on every API call — a missing scope means that operation is rejected as not authorized (HTTP 403).
| Scope | Required for |
|---|---|
| read:cloud_configuration | Querying cloud compliance findings |
Find your API Endpoint URL
Copy the API Endpoint URL field from your Wiz tenant. It is specific to the datacenter hosting your tenant and takes the form:
https://api.[datacenter].app.wiz.io/graphql.
Enable the integration in Nebulock
In Nebulock, go to Settings > Integrations.
In the search bar, type "Wiz" and click Add New Connection.
Enter the connection details:
- Name: a description of your choice, e.g. "Nebulock Wiz"
API Endpoint URL: your tenant's GraphQL endpoint, e.g. https://api.us17.app.wiz.io/graphql
Client ID: the Client ID from the service account credentials dialog
Client Secret: the Client Secret from the service account credentials dialog
Show Image
Click Create Configuration.
Test the integration
Within Nebulock, navigate to Investigate. A simple "List the cloud findings from Wiz" question will pull data from your Wiz tenant.
Updated about 8 hours ago