> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/applications/defining-business-applications.md).

# Define business applications by Criteria

Business applications allow you to define, group, and maintain assets that constitute a logical application with a unified business context. This enables a precise Code to Cloud security posture by correlating risks across the entire development lifecycle.

You can build applications using one of these methods:

* **Application Criteria**: Automatically create and maintain multiple applications in bulk by defining Application Criteria. Criteria allow you to dynamically set rules that group assets into applications based on existing cloud tags or code-based attributes. This ensures consistent grouping and scalable application visibility while reducing manual effort\
  For more information on **creating applications using code based attributes**, refer to [Define applications by Code Criteria](/application-security/application-security-posture-management-aspm/applications/defining-business-applications/define-applications-by-code-criteria.md).\
  For more information on creating applictions using **Cloud-based tags**, refer to [Define applications by Cloud Criteria](/application-security/application-security-posture-management-aspm/applications/defining-business-applications/define-applications-by-cloud-criteria.md).
* **Application Builder**: Provide a starting point from either code or cloud, and Cortex Cloud Application Security automatically maps related assets across the application lifecycle. For more information, refer to [Manually build an application](/application-security/application-security-posture-management-aspm/applications/manually-build-an-application.md)
* **Public API**: Automate application provisioning and synchronize your business context by defining applications programmatically. For more information, refer to [Manage Criteria via the public API](/application-security/application-security-posture-management-aspm/applications/defining-business-applications/manage-criteria-via-the-public-api.md)

## Prerequisites

Before creating criteria in Cortex Cloud Application Security, verify the following requirements.

| Requirement                        | Description                                                                                                                     |
| ---------------------------------- | ------------------------------------------------------------------------------------------------------------------------------- |
| License                            | An active base Cortex Cloud license (Posture or Runtime) with the Application Security module add-on enabled                    |
| RBAC role                          | The AppSec Admin role or a custom role with `read/write` access to application resources in the ASPM module                     |
| VCS integration (Code criteria)    | At least one Version Control System (GitHub, GitLab, Bitbucket, Azure DevOps) integrated and active with onboarded repositories |
| Cloud integration (Cloud criteria) | At least one cloud account (AWS, GCP, Azure) integrated and active with discovered cloud resources                              |
| Criteria limit                     | A maximum of 30 Criteria can exist per tenant                                                                                   |
| **API key (optional)**             | A valid Cortex Cloud API key with ASPM read/write permissions. Required only for programmatic Criteria management               |

## Core achievements

* **Automated application provisioning**: Creating a single criteria definition generates multiple applications automatically, eliminating the need to create each application individually through the console
* **Dynamic asset grouping**: Criteria continuously evaluate the asset inventory. As new repositories are onboarded or cloud resources are provisioned, matching assets are automatically added to the appropriate applications. Assets that no longer match are automatically removed
* **Consistent business context**: Criteria enforce uniform business metadata (ownership, criticality) across all generated applications, preventing inconsistent manual configurations
* **Scalable application management**: Organizations with hundreds of repositories or cloud accounts can manage application definitions through a small number of criteria rules rather than maintaining individual application configurations

## Core concepts

#### Criteria types

Cortex Cloud supports two Criteria types, targeting different asset domains. Select the type that matches the source of organizational truth for your applications.

| Type      | Asset domain     | Grouping mechanism                                                                                                                                                                                 | Use when                                                                                                                                                                                                                |
| --------- | ---------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Code**  | VCS repositories | Groups assets by VCS hierarchy (organization, project, or repository). A single code Criteria can target multiple VCS provider types in the same rule (for example, GitHub, GitLab, and Bitbucket) | Grouping code repositories and their connected runtime/deployment assets into applications based on VCS structure. This is the most common Criteria type for organizations with code-centric ownership models           |
| **Cloud** | Cloud resources  | Groups assets by shared cloud resource tag key-value combinations within a single cloud account                                                                                                    | Grouping cloud resources (compute instances, serverless functions, storage) into applications based on existing tagging conventions. Use this when the cloud tag model is the source of truth for application ownership |

#### Code to cloud unification

You do not have to choose between code and cloud Criteria; both operate concurrently. When a Code rule groups a source repository and a Cloud rule groups the live infrastructure running that code, the platform automatically merges them into a single application boundary to provide true end-to-end risk correlation.

#### Continuous evaluation logic

The Criteria engine operates on a continuous evaluation model. It evaluates rules immediately upon saving and re-evaluates them on a periodic background cadence. As repositories are added, renamed, or removed, and as cloud resources gain or lose tags, the engine automatically updates application membership without manual intervention.

#### How business context prioritizes risk

When you define a Criteria rule, you assign business tags that every generated application automatically inherits. The platform uses these tags to prioritize issues.

**Business criticality** directly influences **Urgency** calculations. High business criticality elevates the Urgency tier of every issue associated with the application.

**Business owner** determines who receives notifications and owns issue remediation.

#### Application access and policy scope

Criteria-generated applications define the scope for security controls. The platform uses these boundaries to enforce Unified Application Security Policies and Scope-Based Access Control (SBAC).

**SBAC** scopes user access to specific application boundaries. **Policies** scope security enforcement to application boundaries. Refer to [Scope user access to applications (Application SBAC)](/application-security/application-security-posture-management-aspm/applications/scope-user-access-to-applications-application-sbac.md)for more information.

## Workflow management

You can manage application criteria through two distinct workflows; the Cortex Cloud Application Security for visual configuration and inventory management, and the Cortex Cloud Public API for programmatic provisioning and infrastructure-as-code integration.

| Capability                  | Tenant (UI) | API |
| --------------------------- | ----------- | --- |
| Create Criteria             | ✓           | ✓   |
| Edit Criteria               | ✗           | ✗   |
| Delete Criteria             | ✓           | ✓   |
| Manual Refresh              | ✗           | ✗   |
| List Criteria               | ✓           | ✓   |
| View Criteria details       | ✓           | ✓   |
| View generated applications | ✓           | ✓   |

## Manage Criteria

Manage existing Criteria in the criteria inventory table. For tenant (UI) instructions, see [Manage Criteria via the tenant (UI)](/application-security/application-security-posture-management-aspm/applications/defining-business-applications/manage-criteria-via-the-tenant-ui.md).

For programmatic management, see [the Criteria API](/application-security/application-security-posture-management-aspm/applications/defining-business-applications/manage-criteria-via-the-public-api.md).


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/applications/defining-business-applications.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.