Integrate Wiz with Red Canary

Limited Access Feature

The Wiz integration is currently available by invitation as a Limited Access feature. For more information about our Limited Access program, please see Red Canary Release Stages. To enable Red Canary to investigate your Wiz alerts, contact your Red Canary account representative or open a support ticket to request access to Wiz Alert Investigations.

This guide outlines how to integrate Wiz with Red Canary’s MDR for Cloud offering. Wiz is a cloud-native security platform that provides comprehensive posture analysis and threat detection across your cloud environments. The integration combines Wiz detection capabilities with Red Canary’s expert investigation, enabling our teams to investigate Wiz-generated alerts and enrich Red Canary investigations with valuable Wiz risk context. For more information on how Red Canary ingests data from Wiz, see the FAQ.

Prerequisites

Before you start the Wiz integration, please make sure the following requirements are met:

• You have an active Red Canary MDR Cloud subscription

• You are sending control plane telemetry to Red Canary through the AWS, Azure, or GCP integrations

• You have the following Wiz licenses:

  • Wiz Advanced Cloud License: This is the minimum required license and must include Threat Detection Issues, Toxic Combinations, and Cloud Config Findings.

  • Wiz Defend Ingestion Add-on: This add-on enables additional features. To ingest identity threats and additional detections into Red Canary, you must have the Wiz Defend add-on and at least one integrated identity provider (Okta, Entra ID, or Google Workspace).

• You consent to the required permissions (configured in Step 3). For more details, see the FAQ.

1 Red Canary | Add the Integration

1. From your Red Canary homepage, go to the Integrations page, then click Add Integration.
   

2. On the Add integration dialog, search for the Wiz integration, then click Configure.
   

3. On the Red Canary configuration page, enter a name for the integration.
   

2 Red Canary | Choose How Red Canary Will Receive This Data

1. On the Red Canary configuration page, set Ingest Format / Method to Wiz via API Poll.
   

2. Click Next.

3 Wiz | Create a Service Account

1. From your Wiz dashboard, go to Settings > Service Accounts.
   

2. On the Service Accounts page, click Add Service Account.
   

3. Name the service account.
   

4. From the Type dropdown, select Custom Integration (GraphQL API).
   

5. Leave Projects and Expiration Date blank.

6. In the API Scopes section, enable the following permissions:

   • Issues

     • Read/list (read:issues)

     • Read/list (read:threat_issues)

   • Threat Issues

     • Read/list (read:threat_issues)

   • Issue Status

     • Write Status (write:issue_status)

   • Issue Comments

     • Create, update, delete (write:issue_comments)

   • Cloud Events

     • Read (read:cloud_events_cloud)

   • Automation Actions

     • Read/list (read:automation_actions)

     • Update (update:automation_actions)

     • Create (create:automation_actions)

   • Integrations

     • Read/list (read:integrations)

     • Update (update:integrations)

     • Create (create:integrations)

   • Action Templates

     • Read/list (read:action_templates)

     • Create (create:action_templates)

     • Delete (delete:action_templates)

   • Automation Rules

     • Read/list (read:automation_rules)

     • Update (update:automation_rules)

     • Create (create:automation_rules)

   • Inventory

     • Read/list (read:inventory)

   • Cloud Accounts

     • Read/list (read:cloud_accounts)

   • Detections

     • Read/list (read:detections)
       

   To learn more about why Red Canary needs these permissions, see the FAQ.

7. Click Add Service Account.

4 Wiz/Red Canary | Configure Red Canary to Retrieve Data from This Integration

Warning

Do not click Finish until you’ve copied and pasted both secret credentials into Red Canary in the step below.

1. Copy your secret credentials and paste them into the Red Canary configuration page:

   • Paste Client ID into the Wiz OAuth Client ID field.

   • Paste Client Secret into the Wiz OAuth Client Secret field.
     

     

2. Return to Wiz and click Finish.

3. In the top-right corner, click your user icon, then Tenant Info.
   

4. From the General tab:

   • Paste API Endpoint URL into the Wiz API base URL field.

   • Paste Authentication URL into the Wiz OAuth Token URL field.
     

     

5. To obtain the Auth Token URL, follow the steps in the Wiz documentation, then paste it into the Wiz OAuth Audience field.
   

6. Click Next.

5 Red Canary | Customize How Data From This Integration Is Handled

[OPTIONAL] You can enable Process Correlation, which allows Red Canary to correlate user-defined alerts from Wiz with our rule metadata when displaying them in the timeline:

1. Check the Enable process correlation for user-defined alerts box.

2. Click Next.

6 Red Canary | Customize How This Data Is Retained

[OPTIONAL] If you’re subscribed to the Red Canary Security Data Lake managed storage solution, you can choose to copy the telemetry generated by the integration to long-term storage for later query or retrieval.

1. Check the Store in the Security Data Lake box.

2. Enter your desired data retention period in days. The maximum is 1095 days (three years).
   

7 Red Canary | Activate the Integration

After you’ve completed the configuration, click Save to activate the integration.

The Wiz integration is now live!

Wiz data should appear in Red Canary within 5 minutes, provided it is a supported data type that meets our filtering criteria. For additional details, see the FAQ.

8 Red Canary | Modify the Integration

After the Wiz integration is active, you can make the following modifications to the configuration:

• Update the API configuration used by the integration

• Adjust the Security Data Lake retention period

• Decommission the integration

To modify the configuration:

1. From your Red Canary homepage, go to the Integrations page, then click on the name of the integration you want to modify.
   

2. After you’ve finished editing the configuration, click Save to apply your changes.

Deleting the Integration

To delete the integration from Red Canary, click the button, then click OK to confirm.

Important

Deleting the integration will prevent any new alerts from being sent to Red Canary. While existing threat data will remain, all processed alerts will be permanently deleted, and this action cannot be undone.

For this reason, we recommend deactivating the integration instead, which will retain all previously processed alerts but stop further ingestion. You can reactivate the integration at any time.

FAQ