---
sourceDocument: Brazil Security Management
sourceDocumentLink: https://www.servicenow.com/docs/r/security-management

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Configure

# Configure the Vulnerability Response Integration with Wiz {#ariaid-title1}

Release version: Brazil  
Updated October 27, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 5 minutes to read  
Configure the integration in your Wiz service account and assign roles in your ServiceNow AI Platform instance.

## Before you begin

You must configure the integration tile in your Wiz account that was created for this integration with the permissions pre-selected. See the [Wiz](https://app.wiz.io/login) product documentation for more information.

The following Wiz API permissions are required. Identify the integrations you want to use to import data adn assign the API permissions accordingly. For more information about the integrations included with Wiz
Vulnerability Response Integration, see [Understanding the Vulnerability Response Integration with Wiz](https://www.servicenow.com/docs/2uHVQD7ri7fPpI2ZEQOZeg "Import vulnerability and compliance data from Wiz scanners into your ServiceNow AI Platform instance to help you get deeper insights into your cloud infrastructure risks. These integrations provide you with a comprehensive assessment of your overall cloud security posture and help you drive remediation actions directly from your instance.").  
{#vr-config-wiz-host-vuln__table_mpc_vnx_z3c__entry__3}

| If you're using USEM and these Vulnerability Response Integration with Wiz integrations ... | Required Wiz API permissions | Integrations, the data they import from Wiz, and records created and updated in your instance |
|-|-|-|
| Wiz Host Vulnerability Integration | \[read:host_configuration\] \[read:vulnerabilities\] | Import findings related to virtual machines and serverless assets in your cloud environment. These findings are mapped to Host Vulnerable Items (VITs). |
| Wiz Asset Integration | \[read:resources\] | Import data about your cloud assets reported by the Wiz scanner. Create and update discovered item records for cloud assets in your ServiceNow® AI Platform instance. |
| Wiz Container Vulnerability Response Integration | \[read:cloud_configuration\] | Import and evaluate container image vulnerability data for vulnerable and non-compliant assets in your cloud infrastructure. Findings are mapped to container vulnerable items (CVITs). |
| Wiz Host Test Results, Configuration Compliance, and Issues Integrations | \[read:issues read:threat_issues\] | * Host Test Results Integration - Import test results associated with the resource type, VIRTUAL MACHINE into Configuration Compliance test results (CTRs). * Configuration Compliance Integration - Import and evaluate configuration test results from Wiz to detect non-compliant cloud configurations. Findings are mapped to cloud test results (CTRs) in the Configuration Compliance Issues Integration - Import Wiz Issues that identify assets involved in toxic combinations of vulnerabilities and misconfigurations.These findings are mapped to CTRs in Configuration Compliance and labeled with "Wiz Issues" as the source. {#vr-config-wiz-host-vuln__ul_hsz_wqx_z3c} |
| Wiz Application List and SCA and Secret Findings Integrations | \[read:secret_instances\] | Import application, Software Composition Analysis (SCA), findings, Secrets findings (passwords, tokens and keys) to create application vulnerable items (AVITs). |
[ ]

{#vr-config-wiz-host-vuln__table_mpc_vnx_z3c}  
Role required:

* admin to assign roles in your ServiceNow AI Platform instance.
{#vr-config-wiz-host-vuln__ul_ijl_cxh_bgc}

## Procedure

1. Assign roles to users for the Wiz integration and for the applications that support the integration in your ServiceNow AI Platform instance.
   1. Navigate to User administrationUsers
   2. Assign the following roles.  
      * sn_vul.vulnerability_admin to configure the Vulnerability Response and Container Vulnerability Response applications.
      * sn_vulc.admin
      * sn_vul_wiz.configure_integration to set up the integration.
      * sn_vul_wiz.read_integration for the users in your organization who you want to view data and records for this integration.
   3. See [User administration](https://www.servicenow.com/docs/access?context=c_UserAdministration&version=brazil&pubname=brazil-platform-administration&ft:locale=en-US) for more information about creating users and managing roles.
   {#vr-config-wiz-host-vuln__substeps_k5z_5ss_rfc}
2. As a user with the sn_vul_wiz.configure_integration role, navigate to AllWiz Vulnerability IntegrationAdministrationConfiguration in your instance.
3. Verify your Application scope \[![Globe icon]()\] is set for the Vulnerability Response Integration with Wiz
4. Fill in the fields.  
   {#vr-config-wiz-host-vuln__id_ypr_lct_rfc__entry__2}

   | Field | Description |
   |-|-|
   | Integration instance | Vulnerability Response Integration with Wiz. |
   | Auth URL | Authentication URL you entered in your Wiz environment. |
   | Api URL | API URL you entered in your Wiz environment. |
   | Client ID | Client ID you want to use for this integration you entered in your Wiz environment. |
   | Client Secret | Client Secret you want to use for this integration you entered in your Wiz environment. |
   [ ]

   {#vr-config-wiz-host-vuln__id_ypr_lct_rfc}
5. Select Save and test.  
   A message is displayed if the credentials have been saved and validated successfully.
6. **Optional:** Verify the detection key combination for the Host Vulnerability integration is populating data on findings.  
   * Starting with versions 30.3 (USEM workspace-compatible) and 1.3 (legacy workspace), the detection key uses the Universally Unique Identifier (UUID) to identify unique detections for the Wiz Host Vulnerability integration. New detections generated by the Host Vulnerability integration use this key field.  
     Note:  
     You must run a full import to view the detections that are updated by the new key.
   * Prior to versions 30.3 (USEM-workspace-compatible) and 1.3, the detection key combination for the Wiz Host Vulnerability integration by default consisted of vulnerability, asset_id, and proof.  
     Note:  
     After you upgrade, detections that used the key combination of vulnerability, asset_id, and proof are automatically closed? Are updated to include the new UUID and maintain the vulnerability, asset_id, and proof properties? .... Or....To view detection information populated with the enhanced key after import, navigate to the Vulnerable Items \[sn_vul_vulnerable_item\] table, select the ![Gear icon to configure column display.]() icon on findings record (VIT), locate the UUID column, and move it from Available toSelected.

   {#vr-config-wiz-host-vuln__ul_xph_zxt_m3c}

   To view the key and modify its properties, follow these steps.  
   Note:  
   You must have the sn_vul.vulnerability_admin role to modify the detection key.
   1. Navigate to AllVulnerability ResponseAdministrationConfigure Detection Granularity.
   2. Select the Wiz link in the Source column.
   3. Make any edits and select Apply Changes.  
      You must run a full import to view the detection data populated by any changes to the key.
   {#vr-config-wiz-host-vuln__substeps_ihs_swt_m3c}
7. **Optional:** Configure Image Vulnerability Keys.  
   You must have the Container Vulnerability Response application installed. You can modify the keys to help you determine how findings (container vulnerable items) for container vulnerabilities are created. For more information about supported keys, system properties, and the scheduled job also required for this step, see [Configuring container image granularity keys for Container Vulnerability Response](https://www.servicenow.com/docs/zg45RTDhUcvW6lSLmSMMbQ "You can configure the keys that generate Container Vulnerability Response findings (container vulnerable items) to help you determine how and when they are created from imported container vulnerability data.") and [Configure container image granularity keys for Container Vulnerability Response](https://www.servicenow.com/docs/JZm7_MNBRq2zokMH1~hhAA "Configure the keys that generate Container Vulnerability Response findings.").

   Return to this page after you modify keys to continue with the configuration.
8. Navigate to AllWiz Vulnerability IntegrationAdministrationIntegrations.
9. Verify the integrations you want to import data with are activated (Active column set to true).
10. Select a record to open it and activate or deactivate the integrations.
11. **Optional:** Select the Schedule tab to modify the run schedule.  
    By default, all the integrations except the Host Test Results Integration are set to run daily. The Host Test Results Integration is set to run on-demand.
12. **Optional:** Backdate an integration run.  
    Select the timestamp link in the Import since column. Select the Import since field and modify the date. Select Update. Select Execute now if you want to run the integration on demand with your new since date.
13. Select Update to save your changes on the integration record.
14. See [Activate the Wiz Asset Integration and identify resource types for import](https://www.servicenow.com/docs/RToeoKjISFULhdF8wPy~IQ "Activate the Wiz Asset Integration and identify only the resource types (assets) with this integration that you want to import.") to identify the asset types that you want to import.

*[\>]: and then