Wiz Integration with DefectDojo

Wiz Integration with DefectDojo

Wiz is a cloud security platform (often grouped under the CNAPP label) that connects to AWS, Azure, Google Cloud, and Kubernetes environments through their APIs and builds a graph of resources, identities, network exposure, and vulnerabilities. Google completed its acquisition of Wiz in 2026. The platform reports two kinds of results: Issues, which are posture and policy violations raised by Wiz Controls, and vulnerability findings, which are CVEs on packages found on cloud assets. Wiz also ships wizcli, a command-line scanner for container images, infrastructure-as-code, and source directories that writes JSON results. Issues and vulnerability findings can be exported from the Wiz console as CSV.

Wiz Integration with DefectDojo

We use Wiz to see what is wrong in our cloud accounts, and DefectDojo to make sure someone fixes it. Wiz is very good at telling us that a storage bucket is public or that a running workload carries a critical CVE. It is less suited to tracking that finding against an application team's SLA alongside their SAST, SCA, and pentest results. Sending Wiz data into DefectDojo puts cloud findings on the same Assets as everything else, with owners, deduplication, and a remediation history that survives the next export. Developers who never log into Wiz see the work in the same queue as the rest of their security backlog.

Why Wiz Matters

Cloud risk is mostly configuration, identity, and exposure, and those are hard to see from inside an application repository. Wiz looks at the environment from the outside in.

• Agentless scanning covers workloads, managed services, and Kubernetes clusters without installing anything on hosts.
• Issues combine context (internet exposure, permissions, sensitive data) so the severity reflects how reachable a problem actually is.
• wizcli brings the same policies into CI, so images and IaC templates can be checked before they are deployed.
• Without a central platform, Wiz findings sit in a separate console from the code and dependency findings for the same service, and nobody gets a combined picture of an application's risk.

Advantages of This Integration

What changed for us once Wiz results flowed through DefectDojo:

• Stable identity across exports. CSV imports carry the Wiz Issue ID or vulnerability finding ID as the unique ID, and DefectDojo deduplicates on that ID first, falling back to a hash of title, description, and severity.
• Status carried over. Wiz OPEN and IN_PROGRESS become active Findings, RESOLVED becomes mitigated (using Wiz's resolved time where present), and IGNORED is imported inactive and out of scope.
• Shift-left and runtime in one view. wizcli image, IaC, and directory scans from the pipeline land next to the runtime Issues Wiz raises later for the same service.
• One SLA policy. Wiz severities map onto DefectDojo's Critical to Info scale, so cloud findings follow the same SLA rules as every other source.
• Ticketing. Findings can be assigned, risk-accepted, or pushed to Jira from DefectDojo, so platform teams get tickets with the resource details attached.

How This Integration Works

Wiz data reaches DefectDojo through four file-based scan types, plus a DefectDojo Pro connector.

Wiz Scan (CSV exports). In the Wiz console, use Export to CSV from the Issues view or from the vulnerability findings view. The parser reads the header row and picks the right layout: a Title column means an Issues export, while Name and DetailedName columns mean a vulnerability export.

Wizcli scans (JSON). Three scan types cover wizcli output. The DefectDojo parser docs show these commands; subcommand syntax has changed between wizcli releases, so confirm against wizcli --help for the version you run.

wizcli docker scan --image myapp:1.4.2 -o scan_img.json,json
wizcli iac scan --path ./ -o scan_iac.json,json
wizcli dir scan --path ./ -o scan_dir.json,json

• Wizcli Img Scan reads OS package vulnerabilities, library vulnerabilities, and secrets from an image scan.
• Wizcli IaC Scan reads IaC rule matches and secrets.
• Wizcli Dir Scan reads library vulnerabilities and secrets from a directory scan.

Import any of these in the UI (Import Scan Results on the Engagement), through the API in Community Edition or DefectDojo Pro, or with Universal Importer in DefectDojo Pro:

curl "https://YOUR_INSTANCE/api/v2/import-scan/" \
  -H "Authorization: Token $DD_API_TOKEN" \
  -F "scan_type=Wiz Scan" \
  -F "file=@wiz-issues.csv" \
  -F "product_name=payments-platform" \
  -F "engagement_name=Cloud Posture" \
  -F "auto_create_context=true"

universal-importer import \
  --defectdojo-url "https://YOUR_INSTANCE.cloud.defectdojo.com/" \
  --scan-type "Wizcli Img Scan" \
  --report-path "./scan_img.json" \
  --product-name "payments-api" \
  --engagement-name "CI" \
  --auto-create-context

Wiz connector (DefectDojo Pro). The connector pulls Issues and vulnerability findings directly from the Wiz API on a schedule. It needs a Wiz service account of type Custom Integration (GraphQL API) with at least the read:projects, read:issues, and read:vulnerabilities scopes, and visibility into the Wiz Projects you want. Enter the Client ID and Client Secret, then choose which data classes to import under Import Finding Types (both are on by default). DefectDojo creates a Record for each Wiz Project plus one tenant-level Record covering the whole tenant, and you map Records to Assets. Mapping a Project Record and the tenant Record together imports that Project's findings into two Assets.

Data Granularity: What Gets Imported

Use Cases

In a container pipeline: Each image build runs wizcli and reimports the JSON into a Test named for the image. Engineers see new CVEs and leaked secrets before the image is pushed, and the security team sees the same image's runtime findings later in the same Asset.

For cloud posture ownership: A platform team exports Wiz Issues weekly and reimports them into one Test per cloud account. Resolved Issues close in DefectDojo, new ones get assigned, and leadership reports on open misconfigurations by team without opening Wiz.

At tenant scale with DefectDojo Pro: An organization with dozens of Wiz Projects maps each Project Record to the matching DefectDojo Asset, and the connector keeps both Issues and vulnerability findings current without anyone running exports.

During IaC review: Terraform changes are scanned with wizcli in pull requests. IaC findings carry file and line, so reviewers can jump straight to the offending block.

Operational Tips

• Expect large volumes from vulnerability data. The connector docs note that a tenant with a few thousand assets can hold millions of vulnerability findings. Start with Issues only if you want posture first.
• Changing Import Finding Types on the connector triggers a full resync, and deselecting a data class closes the Findings already imported from it. Decide before the first sync.
• The connector's Minimum Severity cannot be changed after the connector is created, so choose it deliberately.
• For CSV imports, reimport each export into the same Test. Because Wiz IDs are stable, status changes and resolutions land on the existing Findings.
• wizcli imports put the CVE in the title and description but do not populate the Vulnerability IDs field, so filter wizcli Findings by title text when searching for a specific CVE.
• Use minimum_severity on wizcli imports in busy pipelines and tag them with the image or repository name so they are easy to separate from runtime findings.