AppSec Rules

Cortex AppSec Rules documents the application security rules that Cortex uses to detect misconfigurations, exposed secrets, and insecure pipeline practices across your code and delivery infrastructure. Each rule page describes what the rule detects, why the finding matters, and how to fix the underlying issue.

This reference is for security engineers, DevOps engineers, and developers who triage Cortex AppSec findings and need authoritative detail about a specific rule.

How the reference is organized

Cortex AppSec rules follow a three-level hierarchy:

• Category — A top-level security domain, such as IaC Security or Secrets Security.
• Subcategory — A focused topic within a category, such as Storage under IaC Security or API & Service Keys under Secrets Security.
• Rule — An individual detection. Each rule has its own page.

The reference has three rule categories:

• IaC Security — Rules that detect misconfigurations in Infrastructure as Code, such as Terraform definitions, across cloud providers.
• CI/CD Security — Rules that detect insecure practices in continuous integration and continuous delivery pipelines.
• Secrets Security — Rules that detect exposed secrets, such as API keys and credentials, in your code and configuration.

What a rule page contains

Each rule page opens with the rule name as the page title, followed by these sections:

• Rule Details — A table that lists the rule's metadata. Every rule page includes the Cortex AppSec Rule ID, the Category (or Category - Subcategory), and the Severity. IaC Security rule pages also list the Provider, the Framework, and the Mapped CSPM/KSPM Rule.
• Impact — A description of what the rule detects and why the finding matters.
• Remediation guidance — Instructions for fixing the issue. The heading depends on the rule type, such as How to Fix or Recommended Solution - Buildtime.

Find a rule

To find a rule, use one of the following methods:

• Browse by category and subcategory in the table of contents in the left navigation, then open the rule page you need.
• Open a category landing page, such as IaC Security, to see its subcategories, then open a subcategory page to scan its rule table of rule names, Cortex AppSec Rule IDs, and severities. Some categories, such as Secrets Security, have no subcategories and list all their rules directly on the category landing page.

Each rule has a stable Cortex AppSec Rule ID, such as APPSEC_AWS_22. Use the Cortex AppSec Rule ID to identify a rule consistently across the reference and your Cortex AppSec findings.