Wiz sensor support on GCP

Set up Wiz sensors on Glean compute workloads that run on Compute Engine instances and Google Kubernetes Engine (GKE) nodes in customer-hosted GCP deployments. Glean installs and manages the sensors after you provide the required credentials, secret, and deployment details.

Setup instructions

Glean installs the Wiz sensors through the standard Glean deployment process. You do not need to install the sensors or change the Glean deployment yourself. You provide Glean with the details described on this page so that Glean can deploy Wiz correctly.

Prerequisites

Confirm that you have:

• A Wiz account
• Access to your Wiz tenant and permission to create a service account
• Permission to create a Google Secret Manager secret in the same project as the Glean deployment
• A way to provide the required deployment details to Glean Support

Configuration

Complete these steps before Glean deploys the sensors:

1. In Wiz, create a service account for a Wiz sensor. Follow the Wiz documentation for the required steps. Record the Client ID and Client Secret. Use the client secret later as WIZ_API_CLIENT_SECRET.

2. Collect the runtime sensor image pull key from your Wiz tenant. Go to Wiz tenant information to view the tenant details.

   

   Record these values:

   • Domain: Select registry.wiz.io from the drop-down when possible
   • Username: Use this value later as WIZ_REGISTRY_USERNAME
   • Password: Use this value later as WIZ_REGISTRY_PASSWORD

3. Create the Google Secret Manager secret described in Google Secret Manager secret. Create it in the same project as the Glean deployment.

4. Provide the following details to Glean Support:

   • The Wiz Client ID
   • The Wiz registry Domain
   • The name of the Secret Manager secret

5. After you provide the details, Glean deploys the Wiz sensors.

Google Secret Manager secret

Create a secret in the same project as the Glean deployment. Glean recommends that you encrypt the secret with the Google-managed encryption keys, which is the default.

Secret contents

The secret must contain a JSON string with this structure:

{
    "WIZ_API_CLIENT_SECRET": "ADD-ME",
    "WIZ_REGISTRY_USERNAME": "ADD-ME",
    "WIZ_REGISTRY_PASSWORD": "ADD-ME"
}

Embed these values:

• The Wiz Client Secret for WIZ_API_CLIENT_SECRET
• The image pull registry username for WIZ_REGISTRY_USERNAME
• The image password for WIZ_REGISTRY_PASSWORD

After you create the secret, record the name of the secret so that you can share it with Glean.

Pricing

Because the sensors report back to your Wiz tenant, you are responsible for billing and capacity requirements. This generally requires a billable unit for each Compute Engine instance and GKE node instance. Contact Glean Support to discuss sizing.

See also

• About customer-hosted GCP
• CrowdStrike Falcon support on GCP
• Reduce GCP costs