Configure the Vulnerability Response Integration with Wiz

---
title: Configure the Vulnerability Response Integration with Wiz
description: Configure the integration in your Wiz service account and assign roles in your ServiceNow AI Platform instance.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/vulnerability-response/vr-config-wiz-host-vuln.html
release: australia
product: Vulnerability Response
classification: vulnerability-response
topic_type: task
last_updated: "2026-10-27"
reading_time_minutes: 5
breadcrumb: [Vulnerability Response Integration with Wiz, Vulnerability Response integrations, Vulnerability Response, Unified Security Exposure Management, Security Operations]
---

# Configure the Vulnerability Response Integration with Wiz

Configure the integration in your Wiz service account and assign roles in your ServiceNow AI Platform instance.

## Before you begin

You must configure the integration tile in your Wiz account that was created for this integration with the permissions pre-selected. See the [Wiz](https://app.wiz.io/login) product documentation for more information.

The following Wiz API permissions are required. Identify the integrations you want to use to import data adn assign the API permissions accordingly. For more information about the integrations included with Wiz Vulnerability Response Integration, see [Understanding the Vulnerability Response Integration with Wiz](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response/vr-wiz-exploring-host-cf.md).

<table id="table_mpc_vnx_z3c"><thead><tr><th>

If you're using USEM and these Vulnerability Response Integration with Wiz integrations ...

</th><th>

Required Wiz API permissions

</th><th>

Integrations, the data they import from Wiz, and records created and updated in your instance

</th></tr></thead><tbody><tr><td>

Wiz Host Vulnerability Integration

</td><td>

\[read:host\_configuration\] \[read:vulnerabilities\]

</td><td>

Import findings related to virtual machines and serverless assets in your cloud environment. These findings are mapped to Host Vulnerable Items \(VITs\).

</td></tr><tr><td>

Wiz Asset Integration

</td><td>

\[read:resources\]

</td><td>

Import data about your cloud assets reported by the Wiz scanner. Create and update discovered item records for cloud assets in your ServiceNow® AI Platform instance.

</td></tr><tr><td>

Wiz Container Vulnerability Response Integration

</td><td>

\[read:cloud\_configuration\]

</td><td>

Import and evaluate container image vulnerability data for vulnerable and non-compliant assets in your cloud infrastructure.Findings are mapped to container vulnerable items \(CVITs\).

</td></tr><tr><td>

Wiz Host Test Results, Configuration Compliance, and Issues Integrations

</td><td>

\[read:issues read:threat\_issues\]

</td><td>

-   Host Test Results Integration - Import test results associated with the resource type, VIRTUAL MACHINE into Configuration Compliance test results \(CTRs\).
-   Configuration Compliance Integration - Import and evaluate configuration test results from Wiz to detect non-compliant cloud configurations. Findings are mapped to cloud test results \(CTRs\) in the Configuration Compliance

Issues Integration - Import Wiz Issues that identify assets involved in toxic combinations of vulnerabilities and misconfigurations.These findings are mapped to CTRs in Configuration Compliance and labeled with "Wiz Issues" as the source.


</td></tr><tr><td>

Wiz Application List and SCA and Secret Findings Integrations

</td><td>

\[read:secret\_instances\]

</td><td>

Import application, Software Composition Analysis \(SCA\), findings, Secrets findings \(passwords, tokens and keys\) to create application vulnerable items \(AVITs\).

</td></tr></tbody>
</table>Role required:

-   admin to assign roles in your ServiceNow AI Platform instance.

## Procedure

1.  Assign roles to users for the Wiz integration and for the applications that support the integration in your ServiceNow AI Platform instance.

    1.  Navigate to **User administration** &gt; **Users**

    2.  Assign the following roles.

        -   sn\_vul.vulnerability\_admin to configure the Vulnerability Response and Container Vulnerability Response applications.
        -   sn\_vulc.admin
        -   sn\_vul\_wiz.configure\_integration to set up the integration.
        -   sn\_vul\_wiz.read\_integration for the users in your organization who you want to view data and records for this integration.
    3.  See [User administration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-administration/c_UserAdministration.md) for more information about creating users and managing roles.

2.  As a user with the sn\_vul\_wiz.configure\_integration role, navigate to **All** &gt; **Wiz Vulnerability Integration** &gt; **Administration** &gt; **Configuration** in your instance.

3.  Verify your Application scope \[\[Omitted image "icon-scope-change.png"\] Alt text: Globe icon\] is set for the Vulnerability Response Integration with Wiz

4.  Fill in the fields.

    |Field|Description|
    |-----|-----------|
    |Integration instance|Vulnerability Response Integration with Wiz.|
    |Auth URL|Authentication URL you entered in your Wiz environment.|
    |Api URL|API URL you entered in your Wiz environment.|
    |Client ID|Client ID you want to use for this integration you entered in your Wiz environment.|
    |Client Secret|Client Secret you want to use for this integration you entered in your Wiz environment.|

5.  **Select Save and test**.

    A message is displayed if the credentials have been saved and validated successfully.

6.  Verify the detection key combination for the Host Vulnerability integration is populating data on findings.

    -   Starting with versions 30.3 \(USEM workspace-compatible\) and 1.3 \(legacy workspace\), the detection key uses the Universally Unique Identifier \(UUID\) to identify unique detections for the Wiz Host Vulnerability integration. New detections generated by the Host Vulnerability integration use this key field.

        **Note:** You must run a full import to view the detections that are updated by the new key.

    -   Prior to versions 30.3 \(USEM-workspace-compatible\) and 1.3, the detection key combination for the Wiz Host Vulnerability integration by default consisted of vulnerability, asset\_id, and proof.

        **Note:** After you upgrade, detections that used the key combination of vulnerability, asset\_id, and proof are automatically closed? Are updated to include the new UUID and maintain the vulnerability, asset\_id, and proof properties? .... Or....To view detection information populated with the enhanced key after import, navigate to the Vulnerable Items \[sn\_vul\_vulnerable\_item\] table, select the \[Omitted image "dlp-setting-icon.png"\] Alt text: Gear icon to configure column display. icon on findings record \(VIT\), locate the **UUID** column, and move it from **Available** to**Selected**.

    To view the key and modify its properties, follow these steps.

    **Note:** You must have the sn\_vul.vulnerability\_admin role to modify the detection key.

    1.  Navigate to **All** &gt; **Vulnerability Response** &gt; **Administration** &gt; **Configure Detection Granularity**.

    2.  Select the **Wiz** link in the Source column.

    3.  Make any edits and select **Apply Changes**.

        You must run a full import to view the detection data populated by any changes to the key.

7.  Configure Image Vulnerability Keys.

    You must have the Container Vulnerability Response application installed. You can modify the keys to help you determine how findings \(container vulnerable items\) for container vulnerabilities are created. For more information about supported keys, system properties, and the scheduled job also required for this step, see [Configuring container image granularity keys for Container Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/container-vulnerability-response/cvr-configuring-findings-key-granularity.md) and [Configure container image granularity keys for Container Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/container-vulnerability-response/cvr-configure-key-granularity.md).

    Return to this page after you modify keys to continue with the configuration.

8.  Navigate to **All** &gt; **Wiz Vulnerability Integration** &gt; **Administration** &gt; **Integrations**.

9.  Verify the integrations you want to import data with are activated \(Active column set to `true`\).

10. Select a record to open it and activate or deactivate the integrations.

11. Select the Schedule tab to modify the run schedule.

    By default, all the integrations except the Host Test Results Integration are set to run daily. The Host Test Results Integration is set to run on-demand.

12. Backdate an integration run.

    Select the timestamp **link** in the Import since column. Select the Import since field and modify the date. Select **Update**. Select **Execute now** if you want to run the integration on demand with your new since date.

13. Select **Update** to save your changes on the integration record.

14. See [Activate the Wiz Asset Integration and identify resource types for import](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response/wiz-assets-resources-tab.md) to identify the asset types that you want to import.