> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/backlog-baseline/using-backlog.md).

# Using Backlog

You can leverage the **Backlog** and **New** issue classifications across the platform as follows.

* **Role-Based Access Control (RBAC) / Standard-Based Access Control (SBAC)**: Access and permissions will be managed systematically:
  * By default, only **AppSec Admins** have permission to configure the **issues on existing SBOM are considered new** setting
  * The **Are SBOM issues considered new** setting controls how SBOM-originated findings are classified against the Backlog/New baseline. This setting is disabled by default, meaning that SBOM findings that existed before the initial baseline scan are classified as Backlog, while only SBOM findings detected after the baseline are classified as New. When enabled, all SBOM findings are treated as New regardless of when they were first detected. Only users with the AppSec Admin role can view and modify this setting. To configure, navigate to **Settings** → **Configuration** → **Application Security** → **AppSec Issues Configurations** and enable **Are SBOM issues considered new**
  * Permissions for all other capabilities, such as viewing issues or applying policies, are defined by the existing RBAC/SBAC policies and the user's specific issue management capabilities
* **Policies/Scope**: The system supports **Backlog** and **New** attributes for policies, allowing for differentiated enforcement. Refer to [Create a policy](/application-security/application-security-posture-management-aspm/unified-application-security-policies/create-a-policy.md) for more information
* **Multi-Branch Support**: The Backlog/New classification is consistent across development workflows:
  * The Backlog/New classification is maintained independently for every branch
  * The system allows policies to be defined and applied for specific branches, enabling you to tailor security rules (for example, enforcing stricter policies for **New** critical issues on main branches, or allowing **Backlog** issues on development branches) based on their classification
* You can filter the **Cortex Cloud Application Security dashboard** to display information according to the Backlog/New classification
* **Issues and Findings**: The Backlog/New classification is standardized across data for both findings and issues under the **Backlog Status** field, which is found under the **Overview** tab of both findings and issues side cards. For example, refer to [Navigate to secrets issues](broken://spaces/8Z0RLJ1BFF5TQL8VtUeK/pages/qK2cWoNaeXpUqeehwmmF)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/backlog-baseline/using-backlog.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.