Overview
The Wiz context connector ingests Wiz cloud identities and project data into Torq's Context Graph. This gives Torq the context it needs to enrich alerts, support investigations, and power the Context Graph page.
This is a context and enrichment connector. It builds a picture of your Wiz cloud identities and projects into Torq's organizational Context Graph. It does not route alerts or events into Torq for triage. For Wiz triggers and workflow steps, see Wiz.
What it ingests
Cloud identities: User accounts, service accounts, and groups, each with their associated cloud account and projects.
Projects: Wiz projects, including each project's business impact (HBI, MBI, or LBI).
Key benefits
Simplified setup: Configure ingestion through a guided UI, with no custom polling workflows or API logic required.
Richer triage: Auto Triage uses the Context Graph to enrich alerts with cloud identity and project business impact, helping analysts judge severity faster.
Common scenarios
The same Context Graph powers multiple use cases, regardless of which vendors are connected.
Improving alert triage with organizational context
When an alert involves a user or device, Auto Triage enriches it with context from the Context Graph, including identity, role, group memberships, and access privileges. This context is incorporated into the triage verdict and displayed in the alert's Context Graph section, helping analysts assess risk more quickly.
Investigating entities and relationships
The Context Graph page is where analysts can explore users, accounts, and their relationships without switching between vendor consoles. Common questions include:
Which cloud account and projects does this identity belong to?
What is the business impact of this project?
How are these identities connected?
By centralizing organizational context, the Context Graph enables faster investigations and more informed security decisions.
Prerequisites
Before setting up the Wiz context connector, ensure the following:
Commercial Wiz tenant: Wiz for Government is not supported.
Service account: A Wiz service account with the required scopes must be created before configuration.
How to use
Create a service account in Wiz
Open Service Accounts: In the Wiz console, go to Settings > Service Accounts and click Add Service Account.
Set the type: Select Custom Integration (GraphQL API).
Add scopes: Grant the following scopes:
read:resources: For cloud identities.read:projects: For projects and business impact.
Save and copy credentials: Click Save. Copy the Client ID and Client Secret. Wiz displays the secret only once.
Find your data center: Go to User menu > Tenant Info > Data Centers and Regions and note your data center code (for example,
us17oreu3).
Set up a context connector instance in Torq
Open connector setup: Go to Integrations > Context Graph > Wiz Context Connector and click Add Instance.
Configure connection details:
Instance name: Enter a descriptive name for the connector instance.
Client ID: Enter the service account Client ID.
Client Secret: Enter the service account Client Secret.
Data Center: Enter the data center code only, in lowercase, with no URL (for example,
us17).
Save configuration: Click Add to create the connector. Ingestion starts automatically.
Torq does not test credentials on save. An incorrect Client ID, Client Secret, or Data Center code appears as a failed first sync.
The Wiz context connector is now set up. Torq will continuously ingest cloud identities and project data into the Context Graph, making it available for alert enrichment in Auto Triage and for investigation on the Context Graph page.
If a selected data stream is unavailable due to a missing scope or unsupported configuration, Torq skips that stream and continues ingesting the rest. Only the unavailable subset is missing; other data is unaffected.