Issue Findings
Collects and processes Wiz Issues logs from the Wiz API, enabling continuous monitoring and reporting of security issues across cloud environments.
Sync Type: Incremental
Requirements
Before connecting to Wiz, you need:
- Wiz API credentials (Client ID and Client Secret)
- Appropriate permissions to access Issues API endpoints
- Access to view and list issues in your Wiz account
- Find your tenant data center on the Tenant Info page in Wiz, or request it from your Wiz customer contact. e.g., "us1", "us2", "us3".
Details
This input connects to the Wiz API to fetch issues data. On first connection, it performs a complete sync of all issues. After the initial sync, it automatically switches to incremental updates, only fetching new or modified issues to optimize performance and resource usage.
Configuration
The following configuration defines the input parameters:
NOTE: if you change the configuration of a component in a pipeline it will not reset its state. For example, if you set the project filter the incremental sync will start to pull only for the desired project but you will not get a new FULL sync of all historical data for that project.
:::tip Collecting all issues This connector fetches all issues by default. Every filter below is optional and only narrows what is collected — leaving a filter empty means "don't filter on this field." To ingest everything, leave all filters unset. Selecting values never broadens the result set; it only restricts it.
How selections combine: within a single multi-select field (for example Severity, Status, or Type), the selected values are combined with OR. Different filter fields are combined with AND — an issue must satisfy every field you set. :::
Settings
| Setting | Type | Required | Description |
|---|---|---|---|
| Tenant Data Center | string | Yes | The Wiz tenant data center (e.g., "us17", "eu1") |
| Severity | Array | No | Filter issues by severity levels |
| Status | Array | No | Filter issues by their current status |
| Type | Array | No | Filter issues by issue type (e.g. TOXIC_COMBINATION). Distinct from Risk Type below. |
| Risk Type Any | Array | No | Collect an issue if it matches any one of the selected Wiz risk types (logical OR). Leave empty to not filter on risk type. |
| Risk Type All | Array | No | Collect an issue only if it matches every selected Wiz risk type at once (logical AND). A single issue rarely carries multiple risk types, so selecting more than one value here usually returns no results. Leave empty unless you need a specific risk-type combination — this is not how to collect everything. |
| Framework Category | Array | No | Filter issues by framework category |
| Stack Layer | Array | No | Filter issues by stack layer |
| Project | Array | No | Filter issues by specific projects |
| Has Service Ticket | boolean | No | Filter issues that have associated service tickets |
| Has Remediation | boolean | No | Filter issues that have remediation steps |
| Has Auto Remediation | boolean | No | Filter issues that have automatic remediation capability |
| Backfill Start Time | string | No | The date to start fetching data from. If not specified, no past records will be fetched. |
| API Rate Limit | object | No | Optional limit on the connector's outbound request rate to the source API. Leave blank to use the connector's default behavior. See API Rate Limiting for the field format, limits, and how to choose a value. |
Secrets
| Secret | Type | Required | Description |
|---|---|---|---|
| Client ID | string | Yes | Client ID for the Wiz API authentication |
| Client Secret | string | Yes | Client Secret for the Wiz API authentication |
Data Collection
The input collects the following data from Wiz Issues:
- Issue details and metadata
- Associated resources and entities
- Security findings and vulnerabilities
- Remediation information
- Status and severity levels
- Framework categories and stack layers
- Project associations
- Service ticket information (if available)
Filtering Options
All filters are optional. With no filters set, the connector collects every issue (see Collecting all issues above for how selections combine). Use the criteria below only to narrow what is collected:
- Severity Levels: Filter by issue severity
- Status: Include only issues in specific states
- Type: Filter by issue type
- Risk Type (Any): Collect issues matching any one of the selected risk types (OR)
- Risk Type (All): Collect only issues matching all selected risk types at once (AND)
- Framework Categories: Filter by security framework categories
- Stack Layers: Filter by affected stack layers
- Projects: Limit to specific projects
- Service Tickets: Filter based on ticket association
- Remediation: Filter based on remediation availability
:::warning Getting no data? Check "Risk Type All" Risk Type All is an AND filter: an issue is collected only if it carries every risk type you select. Because a single issue almost never has all risk types at once, selecting multiple values under Risk Type All narrows the feed down to nothing — this is the most common cause of an empty Issue Findings feed.
If you selected boxes under Risk Type All to try to "get more data," clear them. To collect everything, leave both Risk Type Any and Risk Type All empty. :::
Notes
- The test connection functionality will alert you if your filter is too strict and no data is gathered using it.
- No issues coming through? First confirm that issues exist in Wiz for your time window, then clear Risk Type All (see Filtering Options). Remember that with no filters set, the connector already collects all issues.
Sample Record
Code
Sync frequency
This input polls on a connector-specific interval. A cron schedule configured on the pipeline overrides this cadence. See Input Sync Frequency for details.