Wiz Integration

Connect Wiz findings to Keeper Cloud Security for closed-loop remediation.

Overview

The Wiz integration sends cloud security findings into Keeper Cloud Security for remediation. It is built for issues that need credential rotation, managed onboarding, or tighter privileged access controls.

Why Integrate Wiz With Keeper

Wiz identifies exposed identities, risky access paths, and cloud misconfigurations. Keeper helps you act on those findings by turning them into managed privileged access controls.

This integration helps you:

• send relevant Wiz findings directly to Keeper.
• remediate identities and resources with KeeperPAM controls.
• keep remediation status aligned across both systems.

Remediation Workflow

The remediation flow is:

• An admin receives a finding in Wiz.
• The admin reviews the finding and sends it to Keeper for remediation.
• A Keeper admin receives the finding and maps the affected resource in Keeper.
• After remediation, Keeper marks the finding in Wiz as in-progress.
• After the next Wiz validation cycle, the issue is cleared if the risk is resolved.

Keeper uses Keeper Encrypter to preserve zero-knowledge architecture during this exchange.

Setup

1

Deploy Keeper Encrypter

Deploy Keeper Encrypter before you activate the Wiz integration. It receives Wiz webhook traffic and encrypts the integration flow inside your environment.

2

Set Up a Keeper Integration in Wiz

Set up Keeper integration in Wiz next. Make sure to save the client id, client secret and API endpoint URL.

3

Select a PAM configuration

Navigate to secrets manager and select a PAM Configuration you want to link the CNAPP provider to.

In your PAM Configuration:

• Select the gateway you created during Encrypter setup.
• Select the shared folder that stores the encryption key.
• Choose Wiz as the CNAPP status provider.

After you select the provider, choose the CNAPP configuration record created earlier and click on Complete integration setup.

4

Verify the Encrypter Connection

Use the Verify Connection tab to connect Keeper Encrypter to this PAM Configuration.

Use these values from the UI:

• Set NETWORK_UID in the Encrypter .env file to Network UID
• Set KSM_CNAPP_CONFIG_RECORD_ID in the Encrypter .env file to CNAPP Configuration Record UID
• Click Verify. A green checkmark confirms that Keeper Encrypter is connected successfully.

5

Authorize Wiz

In the second tab, enter the credentials provided by Wiz and click Authorize.

User Experience

Cloud Security Dashboard

From the Wiz console, the admin pushes the findings to Keeper through the Keeper Integration in Wiz.

Once pushed, the issues will appear in the Cloud Security dashboard, complete with full context from the CNAPP provider.

Vulnerability Details

A CNAPP provider has identified an exposed credential for an administrative account. In order to start the remediation, hover over the issue and click Resolve.

You can then view a detailed description from the CNAPP provider and onboard the exposed resources to Keeper by selecting Create New Record.

Onboarding a Resource

Select the appropriate record type for the resource you wish to onboard. Then follow their configuration documentation and click Add.

The Cloud Security Dashboard currently supports onboarding of five record types for resources:

1. PAM Database
2. PAM Machine
3. PAM Directory
4. PAM Remote Browser
5. PAM Cloud

Once a resource is onboarded, you can onboard a PAM User record to link to that resource. In cases where the CNAPP provider finds a compromised cloud identity, a PAM User record can directly be onboarded without a PAM Database, PAM Machine, PAM Directory or PAM Remote Browser being onboarded.

Remediating an Issue

Once a resource is successfully onboarded, you can choose between three different remediations:

• Rotate Credential
• Manage Access
• Enable JIT Access

Select the appropriate remediations and click Next.

Select Rotate Credential to edit the rotation settings and customize the newly generated password. Once you have the rotation configured, click Update and then click Save and Continue.

Select Manage Access to edit the connection configuration settings and manage the access to the onboarded resource though a zero trust interactive session. Once you have the connection configured, click Update and then click Save and Continue.

Select Enable JIT to edit the JIT configuration settings and set up Just-in-Time access for the record.

Select Workflow to edit the workflow configuration settings, limit access time to a resource, add required approvers, enable record check-in, and require MFA. Once you have the your JIT rollout configured, click Update and then click Save and Continue.

Keeper then automatically notifies Wiz that the issue has been addressed. The finding moves to the In Progress tab in the Cloud Security dashboard, and the Wiz team sees the updated status on their end without any manual follow-up.

On the next Wiz scan cycle, the exposed credential no longer appears. Once Wiz sends back the resolved finding back to Keeper, it transitions cleanly from In Progress to Resolved.