Unable to Find "Wiz Fetch Vulnerabilities" Integration Processes

[MichelleS384771]

Hello Everyone,

I am currently reviewing the documentation for the Vulnerability Response Integration with Wiz application and noticed that it mentions the following integration processes under Integration Processes Configuration:

1. Wiz Fetch Vulnerabilities - On Demand

   • A comprehensive on-demand process for fetching Wiz vulnerabilities using filters.

2. Wiz Fetch Vulnerabilities Daily Run - New Vulnerabilities

   • A scheduled process that runs daily and fetches vulnerabilities found in the last 24 hours.

3. Wiz Fetch Vulnerabilities Daily Run - Resolved Vulnerabilities

   • A scheduled process that runs daily and fetches vulnerabilities resolved in the last 24 hours.

I am unable to locate any of these configurations, scheduled jobs, or integration processes.

Installed Application Details

• Name: Vulnerability Response Integration with Wiz
• App ID: sn_vul_wiz
• Version: 1.0.13

To rule out a version issue, I also:

• Installed the application in a Personal Developer Instance (PDI)
• Upgraded the application to version 4.0.3

Despite upgrading to 4.0.3, I still cannot find:

• Wiz Fetch Vulnerabilities - On Demand
• Wiz Fetch Vulnerabilities Daily Run - New Vulnerabilities
• Wiz Fetch Vulnerabilities Daily Run - Resolved Vulnerabilities

My Questions

1. Which version were these processes introduced?
2. Is there an additional plugin or dependency that needs to be installed or activated for these jobs to become visible?
3. Are these flows/scheduled jobs renamed in newer releases?
4. Where exactly should I expect to find them (Scheduled Jobs, IntegrationHub ETL, Data Sources, Flows, etc.)?

I would appreciate any guidance from anyone who has successfully implemented the Wiz integration and can confirm:

• The application version where these processes are available.
• Any prerequisites required.
• The navigation path to view or configure them.

Thank you in advance for your help.

[Tanushree Maiti]

Hi @MichelleS384771 

Refer this post: https://www.servicenow.com/community/secops-forum/wiz-integration-clarification-on-last-found-not-up...

Also Could you check  following ServiceNow documentation and mention job:

https://www.servicenow.com/docs/r/security-management/vulnerability-response/vr-wiz-host-vuln-instal...

[andy_ojha]

Hey there,

I believe we may be mixing up the documentation from the older 3rd party built Wiz integration, with the current ServiceNow built integration for Wiz and Vulnerability Response.

The first screenshot and docs snippet you shared, is from the prior / older Wiz built integration for VR - this was the initial integration approach that has since been modernized, with a separate ServiceNow built integration for Wiz and VR...

You have actually installed the, appropriate, modern ServiceNow built integration for Wiz and VR (screenshots of your PDI).

You can disregard that documentation from the first screenshot as it does not pertain to the modern integration (built/supported by ServiceNow).

This ServiceNow Docs Page walks through the various integration jobs, with the modern, ServiceNow built Store App integration for Wiz and VR

• https://www.servicenow.com/docs/r/yokohama/security-management/vulnerability-response/vr-wiz-explori...

Keep in mind, that specific integration jobs will not appear unless dependent application are installed on your instance -> for example 

• Wiz Configuration Compliance (test results) Integration and Issues integration
  • This integration job will not appear unless you have Configuration Compliance installed 
  • Then this integration job will appear in your list of integration jobs 

For more details about the transition from the older Wiz built and supported integration (your first) screenshot of the docs, and the new modern ServiceNow built integration for Wiz (the right one today, in your PDI)

• https://www.servicenow.com/community/secops-articles/announcement-wiz-integration-with-servicenow-se...

[MichelleS384771]

Hello @andy_ojha ,

Thanks for the clarification regarding the legacy Wiz-built integration and the modern ServiceNow-built integration.

That answers my question regarding the missing "Wiz Fetch Vulnerabilities – On Demand" job.

However, we have a related requirement that I'm hoping you can clarify.

We have observed scenarios where vulnerabilities remain active in Wiz, but no additional updates are received because there has been no status change or update on the Wiz side. As a result, the corresponding VITs in ServiceNow are not refreshed for an extended period and may eventually be auto-closed as stale, despite the vulnerability still being active in Wiz.

Is there a supported mechanism in the modern ServiceNow-built Wiz integration to perform a periodic full synchronization or reconciliation of active vulnerabilities?

For example:

• Re-import all active Wiz findings regardless of update timestamp
• Refresh existing VITs/CVITs even when no change has occurred in Wiz
• Run an on-demand or scheduled "full sync" (e.g., weekly)

If no such capability currently exists, what is the recommended approach to ensure that active Wiz vulnerabilities remain synchronized with ServiceNow over time?

We are particularly interested in understanding whether there is an OOB alternative to the legacy "On Demand" process in the current integration.