> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/unified-application-security-policies/reference-a-finding-type-details.md).

# Reference A: Finding type details

Each policy must include at least one finding type. The available finding types depend on the selected policy type

**Code scanners finding types**

| Finding Type          | Applicable To  | Description                                                                             |
| --------------------- | -------------- | --------------------------------------------------------------------------------------- |
| Vulnerabilities       | Code and Image | CVEs detected in open-source dependencies or container images                           |
| Secrets               | Code and Image | Hardcoded credentials, API keys, and tokens detected in source code or container images |
| IaC Misconfigurations | Code only      | Security misconfigurations in Terraform, CloudFormation, Kubernetes, and Helm templates |
| Code Weaknesses       | Code only      | SAST findings include injection flaws, authentication issues, and insecure patterns     |
| License Issues        | Code only      | Non-compliant open-source license usage detected by SCA                                 |
| Operational Risks     | Code only      | Deprecated dependencies, unmaintained packages, and supply chain risks                  |
| Malware               | Image only     | Malicious software detected in container images                                         |

**CI/CD Configuration scanners finding types**

| Finding Type | Description                                                                                                                                        |
| ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------- |
| CI/CD Risks  | Insecure configurations detected in CI/CD pipelines and Version Control System (VCS) environments, mapped to the OWASP CI/CD Top 10 security risks |

**Drift Detection scanner finding types**

| Finding Type | Description                                                                                                                                                                    |
| ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| IaC Drift    | Configuration drift detected between deployed cloud resources and their IaC definitions, indicating that a compliant IaC baseline has drifted into a non-compliant cloud state |

**Policy selection notes**

* When the CI/CD Configuration scanners policy type is selected, the CI/CD Risks finding type is the only available option and is automatically selected
* When the Drift Detection scanner policy type is selected, the IaC Drift finding type is the only available option and is automatically selected
* Other finding types such as Vulnerabilities, Secrets, IaC Misconfigurations, Code Weaknesses, License Issues, Operational Risks, and Malware are not available for CI/CD Configuration scanners or Drift Detection scanner policies


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/unified-application-security-policies/reference-a-finding-type-details.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.