Wiz

This guide walks you through connecting a Wiz tenant to Clarion. Once connected, Clarion ingests prioritized Wiz Issues over a webhook, syncs cloud inventory into the Brain, and lets agents investigate and write back in Wiz with human approval.

Estimated time: 20–25 minutes. You need a Wiz admin who can create a Custom Integration (GraphQL API) service account, plus integrations:manage in the Clarion workspace.

Prerequisites

A Wiz admin who can create a Custom Integration (GraphQL API) service account. Clarion cannot grant provider permissions.
The GraphQL API endpoint from Wiz Tenant settings
A Clarion workspace where you have integrations:manage

Step 1 — Create the service account

In Wiz, go to Settings → Access Management → Service Accounts (direct link) and create a service account of type Custom Integration (GraphQL API).
Scope it to only the Wiz projects Clarion should see.

Required scope

Scope	Covers
`read:all`	Issue ingestion and investigation, project and inventory context, vulnerability findings, SBOM, Graph Entity, and CloudEvents

Optional writeback scopes

Grant each optional scope only if you want the matching Clarion agent tool:

Scope	Enables
`write:issue_comments`	Add comments to regular Wiz Issues
`write:issue_status`	Mark in progress, reopen, and reject regular Issues
`write:threat_issue_comments`	Add comments to Threat Detection Issues
`write:threat_issue_status`	Mark in progress, reopen, and resolve Threat Detection Issues

Step 2 — Enter credentials in Clarion

Open Clarion and go to Integrations → Wiz.
Enter the API URL — the GraphQL endpoint from Tenant settings, for example https://api.us1.app.wiz.io/graphql. Clarion accepts commercial hosts only; government GraphQL hosts are unsupported.
Choose the Token URL that matches your tenant:

Provider	Token URL
Amazon Cognito (default)	`https://auth.app.wiz.io/oauth/token`
Auth0	`https://auth.wiz.io/oauth/token`

Enter the Client ID and Client Secret.
Click Save.

Save validates that Wiz accepts the OAuth client credentials and that the fixed issuesV2 access check passes. Wiz does not return a trustworthy granted-scope list, so Clarion does not verify the full read surface or the optional write scopes. A missing write permission surfaces when the tool runs.

Step 3 — Add the Issues monitor in Clarion

The Issues monitor is available only after the service account validates.

On Integrations → Wiz, create the Issues monitor. Clarion generates the webhook URL and a bearer token.

Copy the bearer token immediately — Clarion shows it once.

Keep both values at hand; the next two steps paste them into Wiz.

Step 4 — Create the Webhook integration in Wiz

An Automation Rule can only point at a Webhook integration that already exists, so create the integration before you build the rules. One integration serves both.

In Wiz, go to Settings → Deployments → Integrations and add an integration. Under Connect, search for Webhook — or jump straight to the new-webhook form.
Fill in the form:

Field	Value
Name	Anything recognizable, for example `Clarion`. Names must be unique per tenant.
Project Scope	The projects Clarion should receive Issues for
URL	The webhook URL from Step 3
Authentication	Token, with the Clarion bearer token as the value — Wiz then sends `Authorization: Bearer <token>`

Leave Additional Headers, Custom Certificate Authority, and Client Certificate empty, and leave This server is only accessible on-premises unchecked — Clarion’s webhook endpoint is public and uses a publicly trusted certificate.
Save the integration.

This form has no request body. The body is set per Automation Rule in the next step, so one Webhook integration can serve several rules.

Step 5 — Create the Automation Rules

Two rules cover everything Clarion ingests. Both point at the same Webhook integration and post the same body.

Rule	Trigger source	Covers	Clarion Issue kind
Risk	Risk Issue	Toxic combination and cloud configuration Issues	risk
Threat	Threat	Threat detection Issues	threat

For each of the two:

In Wiz, go to Automation → Automation Rules and click Create Rule.
Name the rule and set Project Scope to the same projects as the Webhook integration.
Under Rule Conditions, set WHEN the trigger source from the table IS Created.
Under Then, add an action, choose POST a Webhook, and select the Webhook integration you created in Step 4.
Replace the default body with the template from the Clarion page exactly (Clarion stores it as wizIssuesWebhookTemplate):

{
  "schemaVersion": "wiz-issues/v2",
  "issue": {
    "id": "{{issue.id}}"
  }
}

Save the rule and switch it ON.

The body is identical for both rules. The payload is thin on purpose: Clarion stores the notification durably, then fetches the authoritative snapshot from Wiz by Issue ID and reads the type from it, so the trigger source needs no marker in the payload.

{{issue.id}} is the right variable for both trigger sources. The Detection trigger source uses a different shape ({{detection.issue.id}}) — Clarion does not ingest it, so do not add a third rule for it.

Keep the rules on these two trigger sources. A Wiz Issue whose type is outside TOXIC_COMBINATION, CLOUD_CONFIGURATION, and THREAT_DETECTION still creates a Clarion Issue, but with no kind set, so it will not match kind-scoped agents or views.

What happens next

A new active provider Issue creates one Clarion Issue. Later deliveries refresh the Wiz snapshot only and never change Clarion workflow status.
Connected triage agents pick up new Issues.
Sync assets pulls only the Wiz cloud inventory into the Brain and classifies it into compute, datastore, network, and identity.

Agent tools

Once connected, triage agents can use Wiz tools. Every Wiz write requires explicit human approval in Clarion. Read tools: Issue lookup and search, Issue evidence, project context, Graph Entity, CloudEvents search, vulnerability findings, SBOM artifact groups and component exposure, repositories, technologies, hosted technologies. Write tools: Issue comment, mark in progress, resolve, reject, reopen.

Rotate the bearer token

Rotate the token in Clarion, then replace the Authentication → Token value on the Wiz Webhook integration (Settings → Deployments → Integrations). Deliveries fail in between. The Automation Rules need no change — they reference the integration, not the token.

Rotate the client secret

Re-save the service account in Clarion with the new secret. Changing credentials invalidates the bound asset-inventory, SBOM, and vulnerability-finding sync state, so the next sync starts clean.

Troubleshooting

Save fails

Wrong GraphQL endpoint (a government host is rejected by design)
Wrong token URL for the tenant
Missing read:all

Issues stop arriving, or only some types arrive

Token was rotated in Clarion but not in the Wiz Webhook integration
A rule is switched OFF, or was never created for that trigger source — check both
A rule and the Webhook integration are scoped to different projects

A write tool reports a missing permission

The optional scope was never granted. Clarion never probes for it with a test mutation.

Getting Started

Easy ROI

Knowledge Base

Learn

Integrations

Privacy & Legal

Prerequisites

Step 1 — Create the service account

Required scope

Optional writeback scopes

Step 2 — Enter credentials in Clarion

Step 3 — Add the Issues monitor in Clarion

Step 4 — Create the Webhook integration in Wiz

Step 5 — Create the Automation Rules

What happens next

Agent tools

Rotate the bearer token

Rotate the client secret

Troubleshooting

Save fails

Issues stop arriving, or only some types arrive

A write tool reports a missing permission

​Prerequisites

​Step 1 — Create the service account

​Required scope

​Optional writeback scopes

​Step 2 — Enter credentials in Clarion

​Step 3 — Add the Issues monitor in Clarion

​Step 4 — Create the Webhook integration in Wiz

​Step 5 — Create the Automation Rules

​What happens next

​Agent tools

​Rotate the bearer token

​Rotate the client secret

​Troubleshooting

​Save fails

​Issues stop arriving, or only some types arrive

​A write tool reports a missing permission

Prerequisites

Step 1 — Create the service account

Required scope

Optional writeback scopes

Step 2 — Enter credentials in Clarion

Step 3 — Add the Issues monitor in Clarion

Step 4 — Create the Webhook integration in Wiz

Step 5 — Create the Automation Rules

What happens next

Agent tools

Rotate the bearer token

Rotate the client secret

Troubleshooting

Save fails

Issues stop arriving, or only some types arrive

A write tool reports a missing permission