> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/application-security-rules/create-custom-cortex-cloud-application-security-rules.md).
# Create custom Cortex Cloud Application Security rules
Create custom Cortex Cloud Application Security rules to tailor your security measures to address specific and unique threats to your organization that are not covered by default rules. Custom rules run across branch periodic, PR, and CI scans.
You can create custom rules for:
* **Secrets** scans
* **IaC** scans. Supported frameworks include Terraform, TFPlan (with automatic application of Terraform custom rules), CloudFormation, Kubernetes, Bicep, Helm, Kustomize, Helm and ARM. These scans also apply to serverless deployments
**UI workflow**
Use the custom rule builder to create rules from scratch or clone and customize existing rules, enabling you to tailor them to meet your specific requirements effectively.
**Steps**
1. Under **Modules** select **Application Security** → **AppSec Rules (under Policy Management)** → **Add Rule**.
2. On the **New Rule** dialog box:
1. Provide these details:
* **Name**: The name of the rule
* **Impact**: Describes the potential impact of a detected violation. This description is displayed in the Issues page as well as PR Comments
* **Severity**(required): Determines the priority level assigned to findings identified by the rule
* **Scanner** (required): The type of scanner to be used to detect issues based on the rule
* **Category** (required): Refines the scope of the rule. Values include General, IAM, Monitoring, Networking, Public, Storage, Compute, Kubernetes, Logging, and AI/Machine Learning
* **Subcategory** (required): Further refines the scope of the rule by specifying particular attributes within the selected category
After selecting the category and sub-category, a description of the rule finding that will be based on these selections is displayed.
Example 4. Example
If **IAM** is the category, and **Overly Permissive** is the sub-category, the finding type description is: "Based on the categorization, finding type will be "Overly permissive IAM policies configuration found in infrastructure as code"".
* **Framework**: The framework or language that the rule is designed to apply to, such as Terraform, CloudFormation and ARM
* **Labels:** Assign tags to rules to help categorize, filter, and organize them for easier identification and management
* **Mapped Runtime Rule**: Select a runtime rule from the menu to map to your custom build time rule. This enhances your code-to-cloud visibility, allowing you to prioritize findings which are detected in both build and deployed environments
2. Click Next.
3. On the **Rule Configuration** screen.
1. Provide your rule definition as YAML.
2. Validate the code: Click Validate Code.
3. Provide suggested remediation in AsciiDoc format.
4. Click Done.
The rule is displayed in the rules inventory table.
**API workflow**
For organizations looking to integrate rule management directly into their CI/CD pipelines or infrastructure-as-code provisioning workflows, the `Create custom rule API` operation is the recommended method.
* **Pre-deployment validation**: An advantage of using the API is the **Validate custom rule** operation. You can submit framework definitions to check for syntax errors or invalid detection logic before the rule is officially deployed
* **Automated cloning**: You can also use the API to clone OOTB rules by creating a new custom rule and including the `clonedFromRuleId` field. This enables rapid customization while preserving traceability to the original Cortex Cloud Application Security rule
For more information, refer to [Create or clone an AppSec rule API documentation](https://docs-cortex.paloaltonetworks.com/r/Cortex-Cloud-Platform-APIs/Create-an-AppSec-rule).
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/application-security-rules/create-custom-cortex-cloud-application-security-rules.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.