Reference: Core concepts

Reference details for Application Criteria types, evaluation, business context, and application scope.

Criteria types

Cortex Cloud supports two Criteria types, targeting different asset domains. Select the type that matches the source of organizational truth for your applications.

Type	Asset domain	Grouping mechanism	Use when
Code	VCS repositories	Groups assets by VCS hierarchy (organization, project, or repository). A single code Criteria can target multiple VCS provider types in the same rule (for example, GitHub, GitLab, and Bitbucket)	Grouping code repositories and their connected runtime/deployment assets into applications based on VCS structure. This is the most common Criteria type for organizations with code-centric ownership models
Cloud	Cloud resources	Groups assets by shared cloud resource tag key-value combinations within a single cloud account	Grouping cloud resources (compute instances, serverless functions, storage) into applications based on existing tagging conventions. Use this when the cloud tag model is the source of truth for application ownership

Code-to-Cloud unification

You do not have to choose between code and cloud Criteria; both operate concurrently. When a Code rule groups a source repository and a Cloud rule groups the live infrastructure running that code, the platform automatically merges them into a single application boundary to provide true end-to-end risk correlation.

Continuous evaluation logic

The Criteria engine operates on a continuous evaluation model. It evaluates rules immediately upon saving and re-evaluates them on a periodic background cadence. As repositories are added, renamed, or removed, and as cloud resources gain or lose tags, the engine automatically updates application membership without manual intervention.

How business context prioritizes risk

When you define a Criteria rule, you assign business tags that every generated application automatically inherits. The platform uses these tags to prioritize issues.

Business criticality directly influences Urgency calculations. High business criticality elevates the Urgency tier of every issue associated with the application.

Business owner determines who receives notifications and owns issue remediation.

Application access and policy scope

Criteria-generated applications define the scope for security controls. The platform uses these boundaries to enforce Unified Application Security Policies and Scope-Based Access Control (SBAC).

SBAC scopes user access to specific application boundaries. Policies scope security enforcement to application boundaries. Refer to Scope user access to applications (Application SBAC) for more information.