Connect Wiz for Agentless Runtime Integrity

Connect your Wiz environment to JFrog Runtime to gain agentless runtime integrity — visibility into running workloads, images, and security risks — without deploying the JFrog Runtime Controller or sensors.

JFrog Runtime integrates with Wiz through the Wiz API (OAuth2 client-credentials) to fetch Kubernetes cluster and container inventory from your cloud environments. Once connected, JFrog Runtime correlates live deployment data with Artifactory and Xray to identify security risks across your running containers.

This integration provides Runtime Integrity. For process-level runtime visibility (Runtime Impact), deploy the JFrog Runtime Controller.

Before You Begin

Verify the following before you connect Wiz to JFrog Runtime:

• A Wiz account with access to the Wiz API.
• A Wiz Service Account (OAuth2 client credentials) with read-only permissions for cloud resources and container images. You need:
  • Client ID
  • Client Secret
  • Wiz API URL (for example, https://api.us17.app.wiz.io/graphql)
• JFrog Runtime Security is enabled on your JFrog Platform.
• Admin permissions on the JFrog Platform.

Create a Wiz service account

1. In the Wiz console, go to Settings > Service Accounts.
2. Create a new service account with the read:resources scope.
3. Copy the generated Client ID and Client Secret.
4. Note your Wiz API Endpoint URL (varies by tenant region).

Connect to Wiz

To connect Wiz to JFrog Runtime:

1. In the JFrog Platform, go to Administration > Runtime > Cluster Management.
2. Click Connect your runtime environment.
3. Select Wiz as the provider.
4. Enter the connection details:
   • Client ID — from the Wiz service account
   • Client Secret — from the Wiz service account
   • Wiz URL — your Wiz API endpoint
5. Click Connect.

A progress notification confirms that synchronization has started. Initial synchronization may take a few minutes to several hours, depending on the number of clusters in your Wiz environment. You can navigate away from the page — clusters and workloads appear automatically after sync completes.

Multi-tenant support

You can configure multiple Wiz connections to support organizations that manage multiple Wiz tenants. Each connection appears as a separate entry in the Cloud Connectors table.

Each connector must use a unique Client ID* — the same Wiz service account cannot be reused across two connectors.

Cloud connectors management

After a connection is established, the Cloud Connectors table on the Cluster Management page displays all active connections with the following details:

Supported infrastructure

The Wiz connector invents Kubernetes clusters discovered by Wiz.

Provider mapping includes:

AWS: EKS

Google Cloud: GKE

Microsoft Azure: AKS

The Provider column in Live Assessment / Clusters shows the real infrastructure (e.g. EKS, GKE), not "Wiz". A Connector Name column identifies which Wiz connection sourced the cluster.

Note: AWS ECS / Fargate / EC2 are not part of the Wiz connector inventory path (use the dedicated Fargate / sensor flows for those).

Data synchronization

JFrog Runtime syncs from the Wiz GraphQL API (cloudResourcesV2 for Kubernetes clusters and containers):

First sync is a full inventory.

Later syncs are primarily delta (changes since last successful sync), with a full reconcile at least weekly.

Successful connectors are refreshed on a ~24-hour cadence; failed syncs retry after about an hour.

Image references are parsed/normalized (registry, path, tag, digest). Containers without a resolvable digest are not ingested.

Synchronized data appears in Live Assessment under the Images and Workloads tabs. For more information, see Inspecting Live Software Components.

Risk identification

After data is ingested, JFrog Runtime flags images for the following risks:

• Malicious packages — images containing known malicious dependencies.
• Untrusted registries — images pulled from registries not present in Artifactory.
• Critical and applicable CVEs — vulnerabilities identified through Xray Contextual Analysis.
• Integrity violations — running image digest differs from the original Artifactory digest, indicating potential tampering or drift.

Limitations

The Wiz agentless integration provides Runtime Integrity only. The following capabilities require deploying Runtime Impact sensors:

• Process-level visibility — eBPF-based monitoring of running processes within containers.
• Runtime Impact analysis — identifying which vulnerabilities are actually loaded and exploitable at runtime.

Troubleshooting

Connection fails

• Verify the Client ID, Client Secret, and Wiz URL are correct.
• Confirm the Wiz service account has sufficient permissions (read access to cloud resources and container images).
• Check network connectivity between the JFrog Platform and the Wiz API endpoint.

No clusters or workloads appear

• Initial sync may take several hours for large environments. Check the Status column in the Cloud Connectors table.
• Auth can succeed while inventory still fails (scopes / Wiz coverage) — review Failed status and re-check Wiz permissions.
• If Failed, delete and recreate with verified credentials, or use Resync after the 12-hour cooldown.
• Confirm the Client ID is not already used by another connector.

Images missing from Live Assessment

• Wiz may not index short-lived containers (for example, CI/CD jobs or init containers).
• Images from Wiz with no resolvable digest are excluded to prevent false integrity violations.

Sync duration

Sync duration depends on the size of your Wiz environment. Typical timelines: