> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/applications/defining-business-applications.md).

# Define business applications by Criteria

Criteria serve as the authoritative logic for application grouping. They use rules based on Version Control System (VCS) hierarchies—like organizations, projects, or repositories—and cloud resource tags to dynamically create and maintain your asset inventory.

## Prerequisites

Before creating criteria in Cortex Cloud Application Security, verify the following requirements.

| Requirement                        | Description                                                                                                                     |
| ---------------------------------- | ------------------------------------------------------------------------------------------------------------------------------- |
| License                            | An active base Cortex Cloud license (Posture or Runtime) with the Application Security module add-on enabled                    |
| RBAC role                          | The AppSec Admin role or a custom role with `read/write` access to application resources in the ASPM module                     |
| VCS integration (Code criteria)    | At least one Version Control System (GitHub, GitLab, Bitbucket, Azure DevOps) integrated and active with onboarded repositories |
| Cloud integration (Cloud criteria) | At least one cloud account (AWS, GCP, Azure) integrated and active with discovered cloud resources                              |
| SBAC scope (Code criteria)         | VCS organizations, projects, and repositories must belong to your SBAC Asset Groups                                             |
| Criteria limit                     | A maximum of 30 Criteria can exist per tenant                                                                                   |
| API key (optional)                 | A valid Cortex Cloud API key with ASPM read/write permissions. Required only for programmatic Criteria management               |

## Creation methods

You can build Criteria-based applications using one of these methods:

* **Application Criteria**: Automatically create and maintain applications in bulk. Define rules using either code attributes or cloud tags.
  * **Code Criteria**: Group applications by VCS hierarchy. Refer to [Define applications by code Criteria](/application-security/application-security-posture-management-aspm/applications/defining-business-applications/define-applications-by-code-criteria.md)
  * **Cloud Criteria**: Group applications by cloud resource tags. Refer to [Define applications by cloud Criteria](/application-security/application-security-posture-management-aspm/applications/defining-business-applications/define-applications-by-cloud-criteria.md)
* **Public API**: Automate application provisioning and synchronize your business context by defining applications programmatically. For more information, refer to [Manage Criteria via the public API](/application-security/application-security-posture-management-aspm/applications/defining-business-applications/manage-criteria-via-the-public-api.md)

### Criteria management capabilities

You can manage application criteria through the Cortex Cloud tenant (UI) or programmatically via the Cortex Cloud Public API.

| Capability                  | Tenant (UI) | API |
| --------------------------- | ----------- | --- |
| Create Criteria             | ✓           | ✓   |
| Edit Criteria               | ✗           | ✗   |
| Delete Criteria             | ✓           | ✓   |
| Manual Refresh              | ✗           | ✗   |
| List Criteria               | ✓           | ✓   |
| View Criteria details       | ✓           | ✓   |
| View generated applications | ✓           | ✓   |

## Core achievements

* **Automated application provisioning**: Creating a single criteria definition generates multiple applications automatically, eliminating the need to create each application individually through the console
* **Dynamic asset grouping**: Criteria continuously evaluate the asset inventory. As new repositories are onboarded or cloud resources are provisioned, matching assets are automatically added to the appropriate applications. Assets that no longer match are automatically removed
* **Consistent business context**: Criteria enforce uniform business metadata (ownership, criticality) across all generated applications, preventing inconsistent manual configurations
* **Scalable application management**: Organizations with hundreds of repositories or cloud accounts can manage application definitions through a small number of criteria rules rather than maintaining individual application configurations

## Core concepts

* **Criteria types**: Use code Criteria for VCS repositories or cloud Criteria for tagged cloud resources
* **Code-to-Cloud unification**: Code and cloud Criteria can merge related assets into one application
* **Continuous evaluation**: Criteria update application membership as assets and tags change
* **Business context**: Inherited criticality and ownership determine issue priority and accountability
* **Access and policy scope**: Applications define boundaries for SBAC and security policies

For detailed definitions and behavior, see [Reference: Core concepts](/application-security/application-security-posture-management-aspm/applications/defining-business-applications/reference-core-concepts.md).

## View and manage Criteria

Manage existing Criteria in the criteria inventory table. For tenant (UI) instructions, see [Manage Criteria via the tenant (UI)](/application-security/application-security-posture-management-aspm/applications/defining-business-applications/view-and-manage-criteria-via-the-tenant-ui.md).

For programmatic management, see [the Criteria API](/application-security/application-security-posture-management-aspm/applications/defining-business-applications/manage-criteria-via-the-public-api.md).


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/applications/defining-business-applications.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.