> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/appsec-rules/readme.md).

# AppSec Rules

Cortex AppSec Rules documents the application security rules that Cortex uses to detect misconfigurations, exposed secrets, and insecure pipeline practices across your code and delivery infrastructure. Each rule page describes what the rule detects, why the finding matters, and how to fix the underlying issue.

This reference is for security engineers, DevOps engineers, and developers who triage Cortex AppSec findings and need authoritative detail about a specific rule.

## How the reference is organized

Cortex AppSec rules follow a three-level hierarchy:

* **Category** — A top-level security domain, such as IaC Security or Secrets Security.
* **Subcategory** — A focused topic within a category, such as Storage under IaC Security or API & Service Keys under Secrets Security.
* **Rule** — An individual detection. Each rule has its own page.

The reference has three rule categories:

* [IaC Security](/appsec-rules/iac-security.md) — Rules that detect misconfigurations in Infrastructure as Code, such as Terraform definitions, across cloud providers.
* [CI/CD Security](/appsec-rules/ci-cd-security.md) — Rules that detect insecure practices in continuous integration and continuous delivery pipelines.
* [Secrets Security](/appsec-rules/secrets-security.md) — Rules that detect exposed secrets, such as API keys and credentials, in your code and configuration.

## What a rule page contains

Each rule page opens with the rule name as the page title, followed by these sections:

* **Rule Details** — A table that lists the rule's metadata. Every rule page includes the **Cortex AppSec Rule ID**, the **Category** (or **Category - Subcategory**), and the **Severity**. IaC Security rule pages also list the **Provider**, the **Framework**, and the **Mapped CSPM/KSPM Rule**.
* **Impact** — A description of what the rule detects and why the finding matters.
* Remediation guidance — Instructions for fixing the issue. The heading depends on the rule type, such as **How to Fix** or **Recommended Solution - Buildtime**.

## Find a rule

To find a rule, use one of the following methods:

* Browse by category and subcategory in the table of contents in the left navigation, then open the rule page you need.
* Open a category landing page, such as [IaC Security](/appsec-rules/iac-security.md), to see its subcategories, then open a subcategory page to scan its rule table of rule names, Cortex AppSec Rule IDs, and severities. Some categories, such as [Secrets Security](/appsec-rules/secrets-security.md), have no subcategories and list all their rules directly on the category landing page.

Each rule has a stable Cortex AppSec Rule ID, such as `APPSEC_AWS_22`. Use the Cortex AppSec Rule ID to identify a rule consistently across the reference and your Cortex AppSec findings.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/appsec-rules/readme.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.