Policies

APIs for managing policies

List AppSec policies

get

Retrieves a list of all Application Security policies. You can filter the results by finding types, actions, status, triggers, and custom policy flag.

Required license:

Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on.

Query parameters

statusstring · enumOptional

Current status of the policy.

Default: enabledPossible values:

isCustombooleanOptional

Filter by custom policies (true) or system-provided policies (false)

Header parameters

AuthorizationstringRequired

{api_key}

Example: your_api_key_here

x-xdr-auth-idstringRequired

{api_key_id}

Example: 1

Responses

200

Ok

application/json

dateCreatedstringOptional

The date and time when the policy was created

suggestionHashstringOptional

Unique identifier for the suggested policy

descriptionstringOptional

Description of the policy

idstringRequired

Unique identifier for the policy

namestringRequired

Name of the policy

dateDeletedstringOptional

The date and time when the policy was deleted

deletedBystringOptional

The user or system that deleted the policy

relatedDetectionRulesstring[]Required

List of related detection rules

assetGroupIdsnumber · double[]Optional

List of asset groups to which the policy applies. If the array is empty, the policy applies to all asset groups.

suggestionIdstringOptional

Unique identifier for the suggested policy

createdBystringRequired

The user or system that created the policy

dateModifiedstringOptional

The date and time when the policy was last modified

isClonablebooleanOptional

Indicates if the policy is cloneable

isCustombooleanRequired

Indicates if the policy is a custom policy or a system-provided policy

isEditablebooleanOptional

Indicates if the policy is editable

lastTriggeredstringOptional

The date and time when the policy was last triggered

modifiedBystringOptional

The user or system that last modified the policy

overrideIssueSeverityundefined · enumOptional

Set the severity of the issue and override the system severity. If not used, system severity is kept.

Possible values:

policyTypestringOptional

Indicates the policy type. Auto-assigned by the API based on the Finding Type in conditions. Possible values:

• code_image_scanners: for VULNERABILITY, IAC_MISCONFIGURATION, SECRETS, CODE_WEAKNESS, LICENSES, OPERATIONAL_RISK, MALWARE
• cicd_configuration_scanners: for CICD_RISKS
• drift_detection_scanners: for DRIFT

statusstring · enumRequired

Current status of the policy.

Default: enabledPossible values:

versionnumber · doubleRequired

The version of the policy - goes up by one every policy update

get/public_api/appsec/v1/policies

GET /public_api/appsec/v1/policies HTTP/1.1
Host: api-yourfqdn
Authorization: your_api_key_here
x-xdr-auth-id: 1
Accept: */*

200

Ok

[
  {
    "id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
    "name": "Block Build and Pull Request on Valid secrets",
    "description": "Block Build and Pull Request on Valid secrets in public repository",
    "status": "disabled",
    "isCustom": false,
    "triggers": {
      "periodic": {
        "isEnabled": false,
        "actions": {
          "reportIssue": false
        }
      },
      "pr": {
        "isEnabled": true,
        "actions": {
          "reportIssue": false,
          "reportPrComment": false,
          "blockPr": true
        }
      },
      "cicd": {
        "isEnabled": true,
        "actions": {
          "reportIssue": false,
          "reportCicd": false,
          "blockCicd": true
        }
      },
      "ciImage": {
        "isEnabled": false,
        "actions": {
          "reportIssue": false,
          "reportCicd": false,
          "blockCicd": false
        }
      },
      "imageRegistry": {
        "isEnabled": false,
        "actions": {
          "reportIssue": false
        }
      }
    },
    "isClonable": true,
    "isEditable": false,
    "policyType": "code_image_scanners",
    "conditions": {
      "AND": [
        {
          "SEARCH_FIELD": "Finding Type",
          "SEARCH_TYPE": "EQ",
          "SEARCH_VALUE": "SECRETS"
        },
        {
          "SEARCH_FIELD": "Secret Validity",
          "SEARCH_TYPE": "EQ",
          "SEARCH_VALUE": "VALID"
        }
      ]
    },
    "relatedDetectionRules": [],
    "scope": {
      "AND": [
        {
          "SEARCH_FIELD": "is_public_repository",
          "SEARCH_TYPE": "EQ",
          "SEARCH_VALUE": true
        }
      ]
    },
    "createdBy": "system",
    "modifiedBy": null,
    "deletedBy": null,
    "version": 1,
    "assetGroupIds": []
  }
]

Create an AppSec policy

post

Creates a new Application Security policy.

An application security policy defines how a system responds to application security threats. Each policy consists of Conditions, Scope, Triggers, and Actions.

Triggers determine the execution context, such as a Pull Request, CI pipeline, registry scan, or periodic code scan, while Actions are executed only when both the Condition and Scope criteria are met.

Actions can include generating a remediation issue for detection or actively blocking threats within the PR or CI workflow.

Note: To block threats in the CI workflow, you must integrate the Cortex CLI into your pipeline.

Required license:

Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on.

Limitations

Be aware of the following limitations when creating policies:

Trigger and Action Constraints by Finding Type

1. Code & Image scanners Finding Types (for example, IAC_MISCONFIGURATION, SECRETS, VULNERABILITY, LICENSES, OPERATIONAL_RISK, CODE_WEAKNESS, and MALWARE)

   • For scope filters, only the following parameters are supported:

     • Category
     • Asset Type
     • Provider
     • Business Application Names
     • Application Business Criticality
     • Application Business Owner
     • Tags
     • Image Names
     • Source Branch
     • Repository Name
     • Repository Id
     • Is Public Repository
     • Has Deployed Assets
     • Has Internet-exposed deployed assets
     • Has deployed assets with Access to sensitive data
     • Has deployed assets with privileged capabilities
     • Repository labels
     • Image Architecture
     • Organization URL
   • The category parameter only supports Application, Container Image and Repository values.
   • Setting the overrideIssueSeverity parameter is mandatory when ciImage or imageRegistry actions are enabled.
2. CI/CD Risks Finding Type (CICD_RISKS)

   • Only the Code Periodic Scan trigger is supported.
   • Only the reportIssue action is available.
   • For conditions, the category parameter supports only the following values:

     • Category
     • Application
     • CI/CD Instance
     • CI/CD Pipeline
     • VCS Collaborator
     • VCS Organization
   • For scope filters, only the following parameters are supported:

     • Asset Type
     • Provider
     • Tags
     • Business Application Names
     • Application Business Criticality
     • CI/CD Instance Name
     • CI/CD Instance Id
     • CI/CD Pipeline Name
     • CI/CD Pipeline Id
     • VCS Collaborator Name
     • VCS Collaborator Email
     • VCS Collaborator MFA Enabled
     • VCS Collaborator Last Observed
     • VCS Organization Name
     • Repository Name
     • Repository Id
     • Is Public Repository
3. Drift Finding Type (DRIFT)

   • Only the Code Periodic Scan trigger is supported.
   • Only the reportIssue action is available.
   • For conditions, the category parameter only supports Application and Repository values.
   • For scope filters, only the following parameters are supported:

     • Category
     • Provider
     • Business Application Names
     • Application Business Criticality
     • Application Business Owner
     • Cloud Account
     • Cloud Region
     • Repository Name
     • Repository Id
     • Is Public Repository
     • Has Deployed Assets
     • Has Internet-exposed deployed assets
     • Has deployed assets with Access to sensitive data
     • Has deployed assets with privileged capabilities

General Policy Constraints

1. Third-Party Integration Data

   • For ingested data from third-party integrations:

     • Only the periodic scan trigger is supported, along with the ingestedData action that must be explicitly configured.
2. Multiple Finding Types in Conditions

   • When selecting multiple Finding Type values within a single condition, only common filters across those types are available.
   • To use filters specific to a Finding Type, add another condition group that is separated by the OR operator.
3. Condition and Scope Depth

   • The UI supports up to 2 levels of depth for conditions and scope.
   • The API allows up to 10 levels of depth for more complex policy configurations.
4. Scope vs. Asset Groups

   • You must define either a scope (detailed asset filters) or specify assetGroupIds, but not both in the same policy.
   • If both fields are defined (contain values), then only the assetGroupIds will be applied and the scope will be ignored.
5. Empty Results during Configuration

   • Conditions and scope filters may return empty results during policy configuration.
   • Policies can still be saved for future use.
   • Once the policies are active, they will evaluate the conditions and trigger defined actions if matching results are found.

Header parameters

AuthorizationstringRequired

{api_key}

Example: your_api_key_here

x-xdr-auth-idstringRequired

{api_key_id}

Example: 1

Body

Define the Application Security policy.

Notes:

• The policyType field is auto-assigned by the API based on the Finding Type in conditions, it is not set in the request body.
• The conditions and scope fields are required. The scope can be set to {} for global scope."

descriptionstringOptional

A brief description of the AppSec policy's purpose.

namestringRequired

A unique name for the AppSec policy.

enabledbooleanOptional

Whether the policy is enabled upon creation.

assetGroupIdsnumber · double[]Optional

A list of asset group IDs that the policy should apply to. If the list is empty, the policy applies globally, unless other scope conditions are defined. Note : Cannot be used with the scope parameter.

suggestionIdstringOptional

Unique identifier for the suggested policy to link this policy to.

userSbacnumber · double[]Optional

Asset group IDs representing the user's scoped-based access control (SBAC) permissions at the time the policy is created. Controls which asset groups the policy applies to based on the creator's access. When empty, the policy applies to all user scoped asset groups.

Responses

204

No content

No content

400

Bad Request

The error occurs when the server cannot process the request due to client-side errors in the request body. The error is returned when:

• Required fields are missing
• Field values are invalid (for example, incorrect SEARCH_TYPE for the given SEARCH_FIELD)
• The JSON request body is not structured properly (invalid payload structure)

application/json

409

Conflict.

Resolution

Use a unique policy name that does not match any existing policy.

application/json

500

Internal Server Error

application/json

post/public_api/appsec/v1/policies

POST /public_api/appsec/v1/policies HTTP/1.1
Host: api-yourfqdn
Authorization: your_api_key_here
x-xdr-auth-id: 1
Content-Type: application/json
Accept: */*
Content-Length: 1103

{
  "name": "Critical vulnerabilities in code deployed to internet-exposed assets",
  "description": "Detects critical and high-severity vulnerabilities on deployed assets with internet exposure.",
  "conditions": {
    "AND": [
      {
        "SEARCH_FIELD": "Finding Type",
        "SEARCH_TYPE": "EQ",
        "SEARCH_VALUE": "VULNERABILITY"
      },
      {
        "OR": [
          {
            "SEARCH_FIELD": "Severity",
            "SEARCH_TYPE": "EQ",
            "SEARCH_VALUE": "CRITICAL"
          },
          {
            "SEARCH_FIELD": "Severity",
            "SEARCH_TYPE": "EQ",
            "SEARCH_VALUE": "HIGH"
          }
        ]
      }
    ]
  },
  "scope": {
    "AND": [
      {
        "SEARCH_FIELD": "has_internet_exposed",
        "SEARCH_TYPE": "EQ",
        "SEARCH_VALUE": true
      }
    ]
  },
  "assetGroupIds": [],
  "triggers": {
    "periodic": {
      "isEnabled": true,
      "actions": {
        "reportIssue": true
      }
    },
    "pr": {
      "isEnabled": true,
      "actions": {
        "reportIssue": true,
        "blockPr": true,
        "reportPrComment": true
      },
      "overrideIssueSeverity": null
    },
    "cicd": {
      "isEnabled": true,
      "actions": {
        "reportIssue": true,
        "blockCicd": true,
        "reportCicd": true
      },
      "overrideIssueSeverity": null
    },
    "ciImage": {
      "isEnabled": false,
      "actions": {
        "reportIssue": false,
        "blockCicd": false,
        "reportCicd": false
      },
      "overrideIssueSeverity": null
    },
    "imageRegistry": {
      "isEnabled": false,
      "actions": {
        "reportIssue": false
      },
      "overrideIssueSeverity": null
    }
  }
}

No content

Get an AppSec policy

get

Retrieves detailed information for a specific Application Security policy using its unique policy ID.

Required license:

Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on.

Path parameters

policyIdstringRequired

Unique identifier for the policy

Example: 1db58e20-9e73-498d-8faa-99936e26934c

Header parameters

AuthorizationstringRequired

{api_key}

Example: your_api_key_here

x-xdr-auth-idstringRequired

{api_key_id}

Example: 1

Responses

200

Ok

application/json

dateCreatedstringOptional

The date and time when the policy was created

suggestionHashstringOptional

Unique identifier for the suggested policy

descriptionstringOptional

Description of the policy

idstringRequired

Unique identifier for the policy

namestringRequired

Name of the policy

dateDeletedstringOptional

The date and time when the policy was deleted

deletedBystringOptional

The user or system that deleted the policy

relatedDetectionRulesstring[]Required

List of related detection rules

assetGroupIdsnumber · double[]Optional

List of asset groups to which the policy applies. If the array is empty, the policy applies to all asset groups.

suggestionIdstringOptional

Unique identifier for the suggested policy

createdBystringRequired

The user or system that created the policy

dateModifiedstringOptional

The date and time when the policy was last modified

isClonablebooleanOptional

Indicates if the policy is cloneable

isCustombooleanRequired

Indicates if the policy is a custom policy or a system-provided policy

isEditablebooleanOptional

Indicates if the policy is editable

lastTriggeredstringOptional

The date and time when the policy was last triggered

modifiedBystringOptional

The user or system that last modified the policy

overrideIssueSeverityundefined · enumOptional

Set the severity of the issue and override the system severity. If not used, system severity is kept.

Possible values:

policyTypestringOptional

Indicates the policy type. Auto-assigned by the API based on the Finding Type in conditions. Possible values:

• code_image_scanners: for VULNERABILITY, IAC_MISCONFIGURATION, SECRETS, CODE_WEAKNESS, LICENSES, OPERATIONAL_RISK, MALWARE
• cicd_configuration_scanners: for CICD_RISKS
• drift_detection_scanners: for DRIFT

statusstring · enumRequired

Current status of the policy.

Default: enabledPossible values:

versionnumber · doubleRequired

The version of the policy - goes up by one every policy update

get/public_api/appsec/v1/policies/{policyId}

GET /public_api/appsec/v1/policies/{policyId} HTTP/1.1
Host: api-yourfqdn
Authorization: your_api_key_here
x-xdr-auth-id: 1
Accept: */*

200

Ok

{
  "id": "b2c3d4e5-f6a7-8901-bcde-f12345678901",
  "name": "Image scan policy with all triggers",
  "description": "Detects vulnerabilities, secrets, and malware with CI Image Scan and Registry Image Scan triggers enabled.",
  "status": "enabled",
  "isCustom": true,
  "triggers": {
    "periodic": {
      "isEnabled": false,
      "overrideIssueSeverity": null,
      "actions": {
        "reportIssue": false
      }
    },
    "pr": {
      "isEnabled": false,
      "overrideIssueSeverity": null,
      "actions": {
        "reportIssue": false,
        "reportPrComment": false,
        "blockPr": false
      }
    },
    "cicd": {
      "isEnabled": false,
      "overrideIssueSeverity": null,
      "actions": {
        "reportIssue": false,
        "reportCicd": false,
        "blockCicd": false
      }
    },
    "ciImage": {
      "isEnabled": true,
      "overrideIssueSeverity": "Medium",
      "actions": {
        "reportIssue": true,
        "reportCicd": false,
        "blockCicd": true
      }
    },
    "imageRegistry": {
      "isEnabled": true,
      "overrideIssueSeverity": "Low",
      "actions": {
        "reportIssue": true
      }
    }
  },
  "isClonable": true,
  "isEditable": true,
  "policyType": "code_image_scanners",
  "conditions": {
    "OR": [
      {
        "AND": [
          {
            "SEARCH_FIELD": "Finding Type",
            "SEARCH_TYPE": "EQ",
            "SEARCH_VALUE": "SECRETS"
          },
          {
            "SEARCH_FIELD": "Severity",
            "SEARCH_TYPE": "EQ",
            "SEARCH_VALUE": "CRITICAL"
          }
        ]
      },
      {
        "AND": [
          {
            "SEARCH_FIELD": "Finding Type",
            "SEARCH_TYPE": "EQ",
            "SEARCH_VALUE": "VULNERABILITY"
          },
          {
            "SEARCH_FIELD": "Severity",
            "SEARCH_TYPE": "EQ",
            "SEARCH_VALUE": "HIGH"
          }
        ]
      },
      {
        "AND": [
          {
            "SEARCH_FIELD": "Finding Type",
            "SEARCH_TYPE": "EQ",
            "SEARCH_VALUE": "MALWARE"
          }
        ]
      }
    ]
  },
  "relatedDetectionRules": [],
  "scope": {},
  "dateCreated": "2025-06-15T09:30:00.000Z",
  "createdBy": "API Token 1",
  "dateModified": "2025-06-15T09:30:00.000Z",
  "modifiedBy": "API Token 1",
  "deletedBy": null,
  "version": 1,
  "assetGroupIds": []
}

Update an AppSec policy

put

Updates an existing Application Security policy by policy ID. Use this endpoint to modify the policy’s Conditions, Scope, Triggers or Actions.

Note: To block threats in the CI workflow, you must integrate the Cortex CLI into your pipeline.

Required license:

Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on.

Path parameters

policyIdstringRequired

Unique identifier for the policy

Example: 1db58e20-9e73-498d-8faa-99936e26934c

Header parameters

AuthorizationstringRequired

{api_key}

Example: your_api_key_here

x-xdr-auth-idstringRequired

{api_key_id}

Example: 1

Body

namestringOptional

A unique name for the AppSec policy.

descriptionstringOptional

A brief description of the AppSec policy's purpose.

relatedDetectionRulesstring[]Optional

List of related detection rules.

enabledbooleanOptional

Whether the policy is enabled.

suggestionIdstringOptional

Unique identifier for the suggested policy.

assetGroupIdsnumber · double[]Optional

List of asset groups to which the policy applies. If the array is empty, the policy applies to all asset groups.

userSbacnumber · double[]Optional

Asset group IDs representing the user's scoped-based access control (SBAC) permissions at the time the policy is modified. Controls which asset groups the policy applies to based on the modifier's access. When empty, the policy applies to all asset groups.

Responses

204

No content

No content

422

Unprocessable Entity

application/json

put/public_api/appsec/v1/policies/{policyId}

PUT /public_api/appsec/v1/policies/{policyId} HTTP/1.1
Host: api-yourfqdn
Authorization: your_api_key_here
x-xdr-auth-id: 1
Content-Type: application/json
Accept: */*
Content-Length: 999

{
  "name": "Updated policy name",
  "description": "Updated policy description",
  "conditions": {
    "AND": [
      {
        "SEARCH_FIELD": "Finding Type",
        "SEARCH_TYPE": "EQ",
        "SEARCH_VALUE": "VULNERABILITY"
      },
      {
        "OR": [
          {
            "SEARCH_FIELD": "Severity",
            "SEARCH_TYPE": "EQ",
            "SEARCH_VALUE": "CRITICAL"
          },
          {
            "SEARCH_FIELD": "Severity",
            "SEARCH_TYPE": "EQ",
            "SEARCH_VALUE": "HIGH"
          }
        ]
      }
    ]
  },
  "scope": {
    "AND": [
      {
        "SEARCH_FIELD": "has_deployed_assets",
        "SEARCH_TYPE": "EQ",
        "SEARCH_VALUE": true
      }
    ]
  },
  "triggers": {
    "periodic": {
      "isEnabled": true,
      "actions": {
        "reportIssue": true
      },
      "overrideIssueSeverity": "High"
    },
    "pr": {
      "isEnabled": true,
      "actions": {
        "reportIssue": true,
        "blockPr": true,
        "reportPrComment": true
      },
      "overrideIssueSeverity": null
    },
    "cicd": {
      "isEnabled": true,
      "actions": {
        "reportIssue": true,
        "blockCicd": false,
        "reportCicd": true
      },
      "overrideIssueSeverity": null
    },
    "ciImage": {
      "isEnabled": false,
      "actions": {
        "reportIssue": false,
        "blockCicd": false,
        "reportCicd": false
      },
      "overrideIssueSeverity": null
    },
    "imageRegistry": {
      "isEnabled": false,
      "actions": {
        "reportIssue": false
      },
      "overrideIssueSeverity": null
    }
  }
}

No content

Delete an AppSec policy

delete

Deletes an Application Security policy by its policy ID.

Required license:

Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on.

Path parameters

policyIdstringRequired

Unique identifier for the policy

Example: 1db58e20-9e73-498d-8faa-99936e26934c

Header parameters

AuthorizationstringRequired

{api_key}

Example: your_api_key_here

x-xdr-auth-idstringRequired

{api_key_id}

Example: 1

Responses

200

Ok

application/json

messagestringRequired

delete/public_api/appsec/v1/policies/{policyId}

DELETE /public_api/appsec/v1/policies/{policyId} HTTP/1.1
Host: api-yourfqdn
Authorization: your_api_key_here
x-xdr-auth-id: 1
Accept: */*

200

Ok

{
  "message": "Policy 'd4e5f6a7-b8c9-0123-def0-1234567890ab' was successfully deleted"
}