> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/backlog-baseline/issuefinding-classification-by-scanner.md).

# Issue/Finding classification by scanner

This table details how security issues and findings are classified as either **Backlog** or **New** based on their originating scanner and specific detection scenarios

| Scanner             | Backlog                                                                                                                    | New Issue                                                                                                            | Comment                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
| ------------------- | -------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| IaC                 | The first time an IaC detection rule ran against the code repository                                                       | Issues added through pull requests that are created by a detection rule which previously ran against this repository | If a new AppSec rule runs against the code repository, the detected issue is considered a **Backlog** issue                                                                                                                                                                                                                                                                                                                                                            |
| Secrets             | The first time a secret was detected on the code repository with a specific signature (out-of-the-box or customer-created) | A secret that was added in a pull request                                                                            | If a new signature is added/changed in the secret signature engine (by the vendor or by the user), its first run will be considered a **Backlog** issue                                                                                                                                                                                                                                                                                                                |
| SCA Vulnerabilities | The first time the SCA scanner created an SBOM of the code repository and identified vulnerabilities                       | A vulnerability found in a pull request on a new or updated package                                                  | <ul><li>If there is a new vulnerability on an existing package version, it is considered a <strong>Backlog</strong> issue</li><li>If you set the global parameter <strong>issues on existing SBOM are considered new</strong>, it will be considered a new issue</li></ul>                                                                                                                                                                                             |
| SAST                | The first time the SAST scanner sends results on this code repository and file                                             | A SAST finding that was found on a pull request                                                                      | <p>This classification also applies if you import a SARIF file for a repository.</p><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><ul><li>In some cases/vendors, this is not accurate as findings are deleted every time new findings are uploaded. In such cases, the feature may not be accurate or supported</li><li>For SAST, the vendor does not support policy in pull requests</li></ul></div> |

{% hint style="info" %}

### Note

**Scanner updates and new detections**: When a security scanner is updated to support new languages, detection rules, or capabilities, any issues discovered by these new features for existing code are classified as part of the backlog.
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/backlog-baseline/issuefinding-classification-by-scanner.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.