Follow these instructions to use a built-in, no-code connector hosted by ConductorOne.

1. In ConductorOne, navigate to Admin > Connectors and click Add connector.

2. Search for the appropriate Wiz connector:

   • To pull identities from Wiz, look up Wiz Query and click Add.

   • To pull identities from a shared identity source, look up Wiz ID and click Add.

   Don’t see the Wiz connector you need? Reach out to support@conductorone.com to add Wiz to your Connectors page.

3. Choose how to set up the new Wiz connector:

   • Add the connector to a currently unmanaged app (select from the list of apps that were discovered in your identity, SSO, or federation provider that aren’t yet managed with ConductorOne)

   • Add the connector to a managed app (select from the list of existing managed apps)

   • Create a new managed app

4. Set the owner for this connector. You can manage the connector yourself, or choose someone else from the list of ConductorOne users. Setting multiple owners is allowed.

   If you choose someone else, ConductorOne will notify the new connector owner by email that their help is needed to complete the setup process.

5. Click Next.

6. Find the Settings area of the page and click Edit.

7. Paste your Wiz client ID and secret into the Wiz Client ID and Wiz Client Secret fields.

8. Paste your Wiz API endpoint URL into the Endpoint URL field.

9. Paste your Wiz authentication endpoint URL into the Auth URL field.

10. Specify the Wiz audience in the Audience field (the default is wiz-api).

11. Optional. Specify a Wiz project ID in the Project ID field to limit the scope of the resources queried by the connector.

    You must set a project ID if the service account does not have access to all Wiz projects.

12. Set resource IDs or resource tags.

    You must set resource IDs OR resource tags for the connector to sync successfully. While these fields are each optional, you must set one.

    • Paste the specific resource IDs you want to sync into the Resource IDs field. Use commas to separate the list of IDs.

    • Paste the specific resource tags you want to filter synced entitlements by into the Resource tags field. Format tags as a string containing tags in key-value pairs, using this format:

      [{"key":"key1","val":"val1"},{"key":"key2","val":"val2"}]

13. Optional. Paste the specific resource types you want to sync into the Resource types field. Use commas to separate the list of types. Resource types are case-sensitive.

View a list of available resource types in the Wiz documentation.

1. Click the checkbox if you want to Sync Wiz identities.

2. Click Save.

3. If using the Wiz ID connector, complete these additional steps:

   1. In the Shared identity source area of the page, click Edit.

   2. Select the connector from which you want to pull identities.

   3. Optional. Limit the identities pulled from the connector you selected to only those with a certain entitlement by setting the entitlement.

   4. Click Save.

4. The connector’s label changes to Syncing, followed by Connected. You can view the logs to ensure that information is syncing.

That’s it! Your Wiz connector is now pulling access data into ConductorOne.

Follow these instructions to use the Wiz connector, hosted and run in your own environment.

When running in service mode on Kubernetes, a self-hosted connector maintains an ongoing connection with ConductorOne, automatically syncing and uploading data at regular intervals. This data is immediately available in the ConductorOne UI for access reviews and access requests.

Step 1: Set up a new Wiz connector

1. In ConductorOne, navigate to Connectors > Add connector.

2. Search for Baton and click Add.

3. Choose how to set up the new Wiz connector:

   • Add the connector to a currently unmanaged app (select from the list of apps that were discovered in your identity, SSO, or federation provider that aren’t yet managed with ConductorOne)

   • Add the connector to a managed app (select from the list of existing managed apps)

   • Create a new managed app

4. Set the owner for this connector. You can manage the connector yourself, or choose someone else from the list of ConductorOne users. Setting multiple owners is allowed.

   If you choose someone else, ConductorOne will notify the new connector owner by email that their help is needed to complete the setup process.

5. Click Next.

6. In the Settings area of the page, click Edit.

7. Click Rotate to generate a new Client ID and Secret.

   Carefully copy and save these credentials. We’ll use them in Step 2.

Step 2: Create Kubernetes configuration files

Create two Kubernetes manifest files for your Wiz connector deployment:

Secrets configuration

# baton-wiz-secrets.yaml
apiVersion: v1
kind: Secret
metadata:
  name: baton-wiz-secrets
type: Opaque
stringData:
  # ConductorOne credentials
  BATON_CLIENT_ID: <ConductorOne client ID>
  BATON_CLIENT_SECRET: <ConductorOne client secret>
  
  # Wiz credentials
  BATON_WIZ_CLIENT_ID: <Wiz client ID>
  BATON_WIZ_CLIENT_SECRET: <Wiz client secret>
  BATON_AUTH_URL: <Wiz authentication URL>
  BATON_ENDPOINT_URL: <Wiz API endpoint URL>
  BATON_AUDIENCE: <Audience used to authenticate with Wiz (default is "wiz-api")>
  BATON_PROJECT_ID: <Only sync the Wiz project ID set here. Required if the service account does not have access to all Wiz projects.>

  # Optional: include these credentials to fine-tune what the connector syncs
  BATON_WIZ_RESOURCE_TYPES: <Wiz resource types to sync>
  BATON_SYNC_IDENTITIES: <Enable if Wiz identities should by synced>

  # Set ONE of the following (setting none or both will cause the sync to fail)
  BATON_TAGS: <Tags on the Wiz resources to sync>
  BATON_RESOURCE_IDS: <Wiz resource IDs to sync>

  # Optional: include these settings to enable shared identity syncing
  BATON_EXTERNAL_SYNC_MODE: true
  BATON_EXTERNAL_RESOURCE_C1Z: <The path to the c1z file to sync external Baton resources with>
  BATON_EXTERNAL_RESOURCE_ENTITLEMENT_ID_FILTER: <Optional. The entitlement that external users, groups must have access to sync external Baton resources>

See the connector’s README or run --help to see all available configuration flags and environment variables.

Deployment configuration

# baton-wiz.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: baton-wiz
  labels:
    app: baton-wiz
spec:
  selector:
    matchLabels:
      app: baton-wiz
  template:
    metadata:
      labels:
        app: baton-wiz
        baton: true
        baton-app: wiz
    spec:
      containers:
      - name: baton-wiz
        image: ghcr.io/conductorone/baton-wiz:latest
        imagePullPolicy: IfNotPresent
        envFrom:
        - secretRef:
            name: baton-wiz-secrets

Step 3: Deploy the connector

1. Create a namespace in which to run ConductorOne connectors (if desired), then apply the secret config and deployment config files.

2. Check that the connector data uploaded correctly. In ConductorOne, click Applications. On the Managed apps tab, locate and click the name of the application you added the Wiz connector to. Wiz data should be found on the Entitlements and Accounts tabs.

That’s it! Your Wiz connector is now pulling access data into ConductorOne.