> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/application-security-rules.md).

# Application Security Rules

AppSec rules detect security threats using predefined criteria based on standard compliance frameworks and best practices. Custom rules are supported.

Cortex Cloud Application Security rules detect security threats within your application security environment, which includes the various components, configurations, and interactions within your application that can potentially introduce vulnerabilities or pose risks to its security. Cortex Cloud Application Security rules identify and flag issues based on predefined criteria, ensuring that potential threats are proactively detected and addressed to enhance the overall security posture of your application.

Cortex Cloud Application Security rules cover a wide range of security best practices, inspired by compliance frameworks such as PCI, GDPR, ISO 27001:2013, and NIST, as well as additional best practices beyond regulatory requirements.

{% hint style="info" %}

### Note

The AppSec rules API manages rule definitions and metadata. It does not execute scans, create issues, or enforce policies.
{% endhint %}

Two categories of rules exist in the Cortex Cloud Application Security platform:

* **Out-of-the-box (OOTB) rules** are pre-built detection rules maintained by Cortex Cloud. OOTB rules cover IaC misconfigurations, secrets exposure, SAST weaknesses, CI/CD risks, and SCA vulnerabilities. OOTB rules cannot be deleted. Only labels can be modified on OOTB rules
* **Custom rules** are user-created detection rules for the IaC and Secrets scanners. Custom rules support full lifecycle management; create, modify, validate, and delete.

## Workflows

Choose the workflow that best fits your operational scale.

| Capability      | [UI (Tenant Console)](/application-security/application-security-posture-management-aspm/application-security-rules/tenant-ui-workflow.md) | [Public API](/application-security/application-security-posture-management-aspm/application-security-rules/api-workflows-for-rules.md) | [Terraform](/application-security/application-security-posture-management-aspm/application-security-rules/terraform-workflows-for-rules.md) |
| --------------- | ------------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------- |
| **Use case**    | Ad-hoc creation and testing                                                                                                                | Bulk audits and sync                                                                                                                   | Scalable multi-tenant governance                                                                                                            |
| **Cloning**     | Visual duplication                                                                                                                         | `clonedFromRuleId` field                                                                                                               | Via resource declaration                                                                                                                    |
| **Validation**  | `Validate Code` button                                                                                                                     | Validation endpoint                                                                                                                    | `terraform plan` / HCL                                                                                                                      |
| **Rule format** | Visual or YAML                                                                                                                             | JSON payload                                                                                                                           | HCL `frameworks` block                                                                                                                      |

## Roles and permissions

Access to AppSec rules depends on the permission level assigned to the role.

| Permission level | Description                                                                                                                      |
| ---------------- | -------------------------------------------------------------------------------------------------------------------------------- |
| **None**         | No access to AppSec rules. The AppSec Rules page is not visible                                                                  |
| **View**         | Read-only access to rules, rule details, labels, and related issues. Users can filter and sort the rules table                   |
| **View/Edit**    | Full access to create, modify, clone, delete, enable, and disable rules. Users can modify labels and use the AppSec Rules Wizard |

| Role             | Permission level | Description                                |
| ---------------- | ---------------- | ------------------------------------------ |
| **AppSec Admin** | **View/Edit**    | Full rule management access                |
| **Developer**    | **View**         | Read-only access to rules and rule details |

## Core achievements

* **Detection governance at scale**: Listing and filtering rules programmatically enables systematic audits of detection coverage by scanner, severity, category, compliance standard, and label, replacing manual console reviews
* **Organization-specific detection**: Creating custom IaC and Secrets rules extends detection coverage to address security requirements unique to the organization, beyond the OOTB rule library
* **Label-based rule organization**: Applying labels to rules enables categorization by team, compliance framework, environment, or business unit, supporting scoped policy conditions and filtered rule views
* **Rule customization through cloning**: Cloning OOTB rules into custom rules enables modification of detection logic while preserving traceability to the original rule definition
* **Validation before deployment**: Validating custom rule framework definitions before creation prevents deployment of rules with syntax errors or invalid detection logic


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/application-security-rules.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.