Copy page

Wiz

Cloud Config Findings

Collects and processes Wiz Cloud Configuration Findings logs from the Wiz API, ensuring continuous monitoring and reporting of cloud misconfigurations and vulnerabilities.

Sync Type: Incremental

Requirements

• Before connecting Monad to Wiz, you need to obtain API credentials (Client ID and Client Secret). These credentials allow access to the Wiz API to fetch cloud configuration findings.
• Ensure that your Wiz account has the appropriate permissions to access the necessary API endpoints. To access Cloud Findings specifically, make sure your credentials have the read:cloud_configuration permission.

Details

Monad uses the Wiz API to fetch cloud configuration findings. The LastRunTime filter is applied to retrieve only the findings that were detected or updated after the last successful sync. If this is the first time connecting to the Wiz API, Monad performs a full sync of all available findings.

Configuration

The following configuration defines the input parameters. Each field's specifications, such as type, requirements, and descriptions, are detailed below.

Settings

Setting	Type	Required	Description
Endpoint URL	string	Yes	Endpoint URL to connect to Wiz.
Severity	Array	No	Your Wiz Vendor Severity for Vulnerability Findings.
Status	Array	No	The status of a Vulnerability Finding.
Result	Array	No	Filters data by result type.
Backfill Start Time	string	No	The date to start fetching data from. If not specified, no past records will be fetched.
API Rate Limit	object	No	Optional limit on the connector's outbound request rate to the source API. Leave blank to use the connector's default behavior. See API Rate Limiting for the field format, limits, and how to choose a value.

Secrets

Secret	Type	Required	Description
Client ID	string	Yes	Client ID for the Wiz API. This is required to authenticate requests.
Client Secret	string	Yes	Client Secret for the Wiz API. This is required to authenticate requests.

OCSF Conversion

The following JQ transformation converts Wiz Cloud Configuration Finding data to OCSF Version 1.1.0 compliant format.

Sample Record

Code
{
  "data": {
    "configurationFindings": {
      "nodes": [
        {
          "id": "23ieoqbfdnoenwqs",
          "targetExternalId": "Tom Miller",
          "targetObjectProviderUniqueId": "08b52ca9c8a44c0593d6b3f56235c291",
          "firstSeenAt": "2025-08-11T23:46:39Z",
          "severity": "HIGH",
          "result": "FAIL",
          "status": "OPEN",
          "remediation": "Follow the steps below to ensure that each [Pod](https://kubernetes.io/docs/concepts/workloads/pods) runs containers with allowed additional capabilities: \r\n* The following capabilities are not allowed. \r\n* `securityContext.capabilities.drop` key is set to `ALL`.",
          "resource": {
            "id": "7fe7c53e-0343-9e07-d32b-79af6784d552",
            "providerId": "67eb98e3-31b9-8a5c-9fcc-0fa7a2544f41",
            "name": "Alice Williams",
            "nativeType": "Pod",
            "type": "POD",
            "region": null,
            "subscription": {
              "id": "6bd718b6-9c03-4998-6c11-a27c1b707649",
              "name": "Wiz - PROD",
              "externalId": "08b52ca9c8a44c0593d6b3f56235c291",
              "cloudProvider": "GCP"
            },
            "projects": "Jane Williams",
            "tags": [
              {
                "key": "pod-template-hash",
                "value": "Alice Brown"
              },
              {
                "key": "app.kubernetes.io/name",
                "value": "Tom Brown"
              },
              {
                "key": "app.kubernetes.io/instance",
                "value": "Tom Smith"
              }
            ]
          },
          "rule": {
            "id": "72a39ee6-12fd-0e86-bde4-1e7b0fecd5df",
            "graphId": "08b52ca9c8a44c0593d6b3f56235c291",
            "name": "Alice Johnson",
            "description": "dolore labore minim aute ut velit sint lorem ut aliquip in sed fugiat consectetur minim",
            "remediationInstructions": "dolore quis laboris qui dolor nostrud et duis magna do",
            "functionAsControl": false
          },
          "securitySubCategories": [
            {
              "id": "7b3531bf-a6fa-fa7b-60bd-0c283c5ca134",
              "title": "Peter Smith",
              "category": {
                "id": "08b52ca9c8a44c0593d6b3f56235c291",
                "name": "Tom Jones",
                "framework": {
                  "id": "08b52ca9c8a44c0593d6b3f56235c291",
                  "name": "Jane Williams"
                }
              }
            },
            {
              "id": "08b52ca9c8a44c0593d6b3f56235c291",
              "title": "Jane Miller",
              "category": {
                "id": "08b52ca9c8a44c0593d6b3f56235c291",
                "name": "Jane Jones",
                "framework": {
                  "id": "08b52ca9c8a44c0593d6b3f56235c291",
                  "name": "Alice Jones"
                }
              }
            }
          ]
        }
      ],
      "pageInfo": {
        "hasNextPage": true,
        "endCursor": "daac8d5e-4759-6ab3-a79f-9938343bb6a6"
      }
    }
  }
}

Sync frequency

This input polls on a connector-specific interval. A cron schedule configured on the pipeline overrides this cadence. See Input Sync Frequency for details.