Rules
APIs for managing rules
Get a paginated list of Application Security (AppSec) rules. Supports filtering by enabled state, custom flag, categories, sub-categories, cloud providers, scanners, severities, frameworks, and labels.
Required license: Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on.
Filter rules by their enabled state. Set to true to return only active rules, or false to return only disabled rules. If omitted, rules of both states are returned.
Filter rules by type. Set to true to return only custom rules, or false to return only out-of-the-box rules. If omitted, both rule types are returned.
Filter rules by subcategory. Subcategories further classify the type of security issue within a category and are applicable to IAC rules only. The supported subcategory values depend on the selected categories filter. CICD, SCA, and SECRETS rules do not have subcategories and are retured with a null value.
Filter rules by one or more labels. Returns only rules that have all specified labels assigned.
The number of rules to skip before returning results. Used for pagination together with limit. Set to 0 to start from the first result.
0The maximum number of rules to return per page. Used for pagination together with offset.
100The field by which to sort the returned rules.
namePossible values: The sort direction for the results. Use 1 for ascending order and -1 for descending order.
{api_key}
your-api-key{api_key_id}
1Unique identifier for a scanner rule. When set to true, the scannerRuleId field is included in each rule object returned in the response. If omitted or set to false, the scannerRuleId field is excluded from the response.
Ok
The starting position of the current page of results.
The offset to use in the next request to retrieve the next page of results. Returns null if there are no more results.
100GET /public_api/appsec/v1/rules HTTP/1.1
Host: api-yourfqdn
Authorization: your-api-key
x-xdr-auth-id: 1
Accept: */*
Ok
{
"offset": 1,
"nextOffset": 100,
"rules": [
{
"category": "text",
"cloudProvider": "GCP",
"createdAt": "2026-01-01T00:00:00.000Z",
"description": "text",
"shortDescription": "text",
"detectionMethod": "IaC Security",
"docLink": "text",
"domain": "POSTURE",
"findingCategory": "Code",
"findingDocs": "Custom IaC rule for Public Exposure Storage Buckets",
"findingTypeId": 30040031,
"findingTypeName": "text",
"frameworks": [
{
"frameworkDetails": {
"definition": "text",
"definition_link": "text",
"name": "TERRAFORM",
"remediation_description": "text",
"remediation_ids": [
"text"
],
"resource_types": [
"text"
]
}
}
],
"id": "text",
"isCustom": true,
"isEnabled": true,
"labels": [
"text"
],
"updatedAt": "2026-01-01T00:00:00.000Z",
"mitreTactics": [
"text"
],
"mitreTechniques": [
"text"
],
"name": "text",
"owner": "CAS",
"scanner": "CICD",
"severity": "CRITICAL",
"subCategory": "STORAGE_BUCKETS",
"complianceStandards": {
"standardName": "CIS Amazon Elastic Kubernetes Service (EKS) Benchmark v1.4_copy v1.4",
"controls": [
{
"controlName": "The default namespace should not be used",
"controlDefinition": "Kubernetes provides a default namespace, where objects are placed if no namespace is specified for them. Placing objects in this namespace makes application of RBAC and other controls more difficult."
}
]
},
"cspmRuleId": "text",
"cspmTypeId": 60100018
}
]
}Create a new Application Security Rule. Application Security rules are designed to detect security threats within your application security environment. Application Security rules identify and flag issues based on predefined criteria.
Limitation: This API supports creating custom rules only for IaC Security and Secrets Security. CI/CD Security custom rules are not supported.
Required license: Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on.
{api_key}
your-api-key{api_key_id}
1Define the Application Security custom rule. The category option should match your selection for scanner.
A unique name for the Appsec rule.
S3 Bucket Public Access CheckDescription of the rule
Detects S3 buckets with public access enabledSeverity level of the rule
Labels to be assigned to the rule
S3-SecurityThe type of security scanner used to detect findings of this rule. Choose any one of the scanners.
Custom rule IaC category. Applicable only when scanner is set to IAC.
PUBLICPossible values: Custom rule secret category. Applicable only when scanner is set to SECRETS.
Custom rule subcategory. The supported values depend on the selected category. Refer to the following table for the valid subcategories for each category.
Note: This field is applicable only when scanner is set to IAC.
Category and Subcategory Table for IaC Scanner
| Category | Subcategory |
|---|---|
AI and Machine Learning (AI_ML) | Guardrails (GUARDRAILS) |
AI and Machine Learning (AI_ML) | Risky models (RISKY_MODELS) |
AI and Machine Learning (AI_ML) | Public Exposure (PUBLIC_EXPOSURE) |
AI and Machine Learning (AI_ML) | Permissions (PERMISSIONS) |
Logging (LOGGING) | Encryption (ENCRYPTION) |
Logging (LOGGING) | Permissions (PERMISSIONS) |
Logging (LOGGING) | Retention (RETENTION) |
Logging (LOGGING) | Formats (FORMATS) |
Logging (LOGGING) | Disabled or missing (DISABLED_OR_MISSING) |
Logging (LOGGING) | Public Exposure (PUBLIC_EXPOSURE) |
Logging (LOGGING) | Under Use (UNDER_USE) |
Kubernetes (KUBERNETES) | Network Policies (NETWORK_POLICIES) |
Kubernetes (KUBERNETES) | Access Control (ACCESS_CONTROL) |
Kubernetes (KUBERNETES) | Logging and Monitoring (LOGGING_AND_MONITORING) |
Kubernetes (KUBERNETES) | Resource Management (RESOURCE_MANAGEMENT) |
Kubernetes (KUBERNETES) | Native Security Controls (NATIVE_SECURITY_CONTROLS) |
Kubernetes (KUBERNETES) | Management Services Exposure (MANAGEMENT_SERVICES_EXPOSURE) |
Compute (COMPUTE) | Overprovisioned (OVERPROVISIONED) |
Compute (COMPUTE) | Startup Script Leaks (STARTUP_SCRIPT_LEAKS) |
Compute (COMPUTE) | Default Credentials or Auth (DEFAULT_CREDENTIALS_OR_AUTH) |
Compute (COMPUTE) | Unsanctioned Resource or Type (UNSANCTIONED_RESOURCE_OR_TYPE) |
Storage (STORAGE) | Encryption (ENCRYPTION) |
Storage (STORAGE) | Permissions (PERMISSIONS) |
Storage (STORAGE) | Backups (BACKUPS) |
Storage (STORAGE) | Versioning (VERSIONING) |
Storage (STORAGE) | Replication (REPLICATION) |
Storage (STORAGE) | Alerting (ALERTING) |
Storage (STORAGE) | Redundancy (REDUNDANCY) |
Public (PUBLIC) | Admin Interfaces (ADMIN_INTERFACES) |
Public (PUBLIC) | Database Endpoints (DATABASE_ENDPOINTS) |
Public (PUBLIC) | Storage Buckets (STORAGE_BUCKETS) |
Public (PUBLIC) | APIs (APIS) |
Public (PUBLIC) | Sensitive Ports (SENSITIVE_PORTS) |
Networking (NETWORKING) | Load Balancing (LOAD_BALANCING) |
Networking (NETWORKING) | Ingress Controls (INGRESS_CONTROLS) |
Networking (NETWORKING) | Egress Controls (EGRESS_CONTROLS) |
Networking (NETWORKING) | Encryption and Protocols (ENCRYPTION_AND_PROTOCOLS) |
Networking (NETWORKING) | VPC/VCN/VNET (VPC_VCN_VNET) |
Networking (NETWORKING) | Flow Logs (FLOW_LOGS) |
Monitoring (MONITORING) | Tags and metadata (TAGS_AND_METADATA) |
Monitoring (MONITORING) | Resource Health (RESOURCE_HEALTH) |
Monitoring (MONITORING) | Performance Monitoring (PERFORMANCE_MONITORING) |
Monitoring (MONITORING) | Alerting and Notifications (ALERTING_AND_NOTIFICATIONS) |
Monitoring (MONITORING) | Unintegrated (UNINTEGRATED) |
Monitoring (MONITORING) | Storage (STORAGE) |
IAM (IAM) | Overly Permissive (OVERLY_PERMISSIVE) |
IAM (IAM) | Unused (UNUSED) |
IAM (IAM) | Credential Exposure (CREDENTIAL_EXPOSURE) |
IAM (IAM) | MFA (MFA) |
IAM (IAM) | Role Separation (ROLE_SEPARATION) |
IAM (IAM) | Shared (SHARED) |
IAM (IAM) | Expired Key Controls (EXPIRED_KEY_CONTROLS) |
IAM (IAM) | Authentication Policies (AUTHENTICATION_POLICIES) |
STORAGE_BUCKETSPossible values: The unique identifier of the Cloud Security rule to which the custom Application Security rule will be mapped. Applicable only when scanner is set to IAC.
ff6a26a5-f036-4d3a-a650-d5de1d568babOptional. ID of the source rule from which this rule was cloned. This field is present only for cloned rules.
Created. A new resource was created successfully.
Details of the Application Security rule
Custom Appsec rule category.
The cloud provider associated with the rule. If the rule is not cloud-provider-specific, this field is null.
GCPPossible values: The timestamp when the AppSec rule was created.
The rule description.
A brief summary of the rule. If not provided, this field is null.
Security scanner used to detect findings for this rule.
IaC SecurityA URL linking to the relevant Cortex Cloud documentation page.
The domain associated with the rule.
POSTURECategory of findings this rule generates.
Custom IaC rule for Public Exposure Storage BucketsThe numeric identifier of the finding type associated with this rule.
30040031Display name of the finding type associated with this rule. Matches the rule name for custom rules.
Unique identifier of the AppSec rule.
Indicates whether the rule is a custom rule created by the user (true) or an out-of-the-box rule (false).
Indicates whether the rule is currently active and will generate findings during scans.
Labels assigned to the rule.
The timestamp when the AppSec rule was last modified.
The MITRE ATT&CK tactic identifiers associated with this rule. Returns an empty array if no tactics are mapped.
The MITRE ATT&CK technique identifiers associated with this rule. Returns an empty array if no techniques are mapped.
Name of the Appsec rule.
The internal service owner of the rule.
CASThe scanner type used by this rule to detect security issues.
Severity level of the rule
Custom rule subcategory.
STORAGE_BUCKETSThe ID of the mapped Cloud Security rule. When set, findings from this AppSec rule are correlated with the corresponding Cloud Security rule. Returns null if no rule is mapped.
The numeric type identifier of the mapped Cloud Security rule. Returned only when the AppSec rule is linked to a rule via cspmRuleId.
60100018Bad Request
POST /public_api/appsec/v1/rules HTTP/1.1
Host: api-yourfqdn
Authorization: your-api-key
x-xdr-auth-id: 1
Content-Type: application/json
Accept: */*
Content-Length: 597
{
"name": "S3 Bucket Public Access Check",
"description": "Detects S3 buckets with public access enabled",
"severity": "HIGH",
"scanner": "IAC",
"category": "PUBLIC",
"subCategory": "STORAGE_BUCKETS",
"cspmRuleId": "fddd75de-c838-472c-9b24-5c9127ba5405",
"labels": [
"Custom-Rule",
"S3-Security"
],
"frameworks": [
{
"name": "TERRAFORM",
"definition": "definition:\n cond_type: attribute\n resource_types:\n - aws_s3_bucket_public_access_block\n attribute: block_public_acls\n operator: equals\n value: false",
"remediationDescription": "Set block_public_acls to true in aws_s3_bucket_public_access_block resource"
}
]
}Get the details of the specified Application Security rule.
Required license: Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on.
Unique identifier of the Application Security rule
{api_key}
your-api-key{api_key_id}
1Ok
Details of the Application Security rule
Custom Appsec rule category.
The cloud provider associated with the rule. If the rule is not cloud-provider-specific, this field is null.
GCPPossible values: The timestamp when the AppSec rule was created.
The rule description.
A brief summary of the rule. If not provided, this field is null.
Security scanner used to detect findings for this rule.
IaC SecurityA URL linking to the relevant Cortex Cloud documentation page.
The domain associated with the rule.
POSTURECategory of findings this rule generates.
Custom IaC rule for Public Exposure Storage BucketsThe numeric identifier of the finding type associated with this rule.
30040031Display name of the finding type associated with this rule. Matches the rule name for custom rules.
Unique identifier of the AppSec rule.
Indicates whether the rule is a custom rule created by the user (true) or an out-of-the-box rule (false).
Indicates whether the rule is currently active and will generate findings during scans.
Labels assigned to the rule.
The timestamp when the AppSec rule was last modified.
The MITRE ATT&CK tactic identifiers associated with this rule. Returns an empty array if no tactics are mapped.
The MITRE ATT&CK technique identifiers associated with this rule. Returns an empty array if no techniques are mapped.
Name of the Appsec rule.
The internal service owner of the rule.
CASThe scanner type used by this rule to detect security issues.
Severity level of the rule
Custom rule subcategory.
STORAGE_BUCKETSThe ID of the mapped Cloud Security rule. When set, findings from this AppSec rule are correlated with the corresponding Cloud Security rule. Returns null if no rule is mapped.
The numeric type identifier of the mapped Cloud Security rule. Returned only when the AppSec rule is linked to a rule via cspmRuleId.
60100018GET /public_api/appsec/v1/rules/{ruleId} HTTP/1.1
Host: api-yourfqdn
Authorization: your-api-key
x-xdr-auth-id: 1
Accept: */*
Ok
{
"category": "text",
"cloudProvider": "GCP",
"createdAt": "2026-01-01T00:00:00.000Z",
"description": "text",
"shortDescription": "text",
"detectionMethod": "IaC Security",
"docLink": "text",
"domain": "POSTURE",
"findingCategory": "Code",
"findingDocs": "Custom IaC rule for Public Exposure Storage Buckets",
"findingTypeId": 30040031,
"findingTypeName": "text",
"frameworks": [
{
"frameworkDetails": {
"definition": "text",
"definition_link": "text",
"name": "TERRAFORM",
"remediation_description": "text",
"remediation_ids": [
"text"
],
"resource_types": [
"text"
]
}
}
],
"id": "text",
"isCustom": true,
"isEnabled": true,
"labels": [
"text"
],
"updatedAt": "2026-01-01T00:00:00.000Z",
"mitreTactics": [
"text"
],
"mitreTechniques": [
"text"
],
"name": "text",
"owner": "CAS",
"scanner": "CICD",
"severity": "CRITICAL",
"subCategory": "STORAGE_BUCKETS",
"complianceStandards": {
"standardName": "CIS Amazon Elastic Kubernetes Service (EKS) Benchmark v1.4_copy v1.4",
"controls": [
{
"controlName": "The default namespace should not be used",
"controlDefinition": "Kubernetes provides a default namespace, where objects are placed if no namespace is specified for them. Placing objects in this namespace makes application of RBAC and other controls more difficult."
}
]
},
"cspmRuleId": "text",
"cspmTypeId": 60100018
}Delete the specified Application Security rule.
Required license: Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on.
Unique identifier of the Application Security rule
{api_key}
your-api-key{api_key_id}
1Ok
DELETE /public_api/appsec/v1/rules/{ruleId} HTTP/1.1
Host: api-yourfqdn
Authorization: your-api-key
x-xdr-auth-id: 1
Accept: */*
Ok
{
"message": "text"
}Update an existing Application Security rule. If it's an out-of-the-box rule, the only modification you can make is to add labels. For custom rules, you can modify all of the fields.
Note: To customize an out-of-the-box rule, you can create a custom rule by cloning the existing one. This allows you to make changes to the original rule according to your requirements.
Required license: Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on.
Unique identifier of the Application Security rule
{api_key}
your-api-key{api_key_id}
1Ok
Updated details of the modified Application Security rule
PATCH /public_api/appsec/v1/rules/{ruleId} HTTP/1.1
Host: api-yourfqdn
Authorization: your-api-key
x-xdr-auth-id: 1
Content-Type: application/json
Accept: */*
Content-Length: 633
{
"name": "S3 Bucket Public Access Check",
"description": "Detects S3 buckets with public access enabled",
"severity": "CRITICAL",
"labels": [
"S3-Security"
],
"scanner": "IAC",
"frameworks": {
"name": "TERRAFORM",
"definition": "definition:\\n cond_type: attribute\\n resource_types:\\n - aws_s3_bucket_public_access_block\\n attribute: block_public_acls\\n operator: equals\\n value: false",
"definitionLink": "text",
"remediationDescription": "Set block_public_acls to true in aws_s3_bucket_public_access_block resource"
},
"category": "PUBLIC",
"subCategory": "STORAGE_BUCKETS",
"cspmRuleId": "ff6a26a5-f036-4d3a-a650-d5de1d568bab",
"clonedFromRuleId": "text"
}Ok
{
"rule": {
"category": "PUBLIC",
"cloudProvider": null,
"createdAt": {
"value": "2024-01-01T00:00:00.000Z"
},
"description": "Detects S3 buckets with public access enabled",
"detectionMethod": "IaC Security",
"domain": "POSTURE",
"findingTypeId": 30040031,
"frameworks": [
{
"definition": "definition:\n cond_type: attribute\n resource_types:\n - aws_s3_bucket_public_access_block\n attribute: block_public_acls\n operator: equals\n value: false\nmetadata:\n name: S3 Bucket Public Access Check\n category: public\n severity: high\n guidelines: Detects S3 buckets with public access enabled\n",
"definitionLink": null,
"name": "TERRAFORM",
"remediationDescription": "Set block_public_acls to true in aws_s3_bucket_public_access_block resource",
"remediationIds": [],
"resourceTypes": []
}
],
"id": "APPSEC_CUSTOM_<rule-id>",
"isCustom": true,
"isEnabled": true,
"labels": [
"Custom-Rule",
"S3-Security"
],
"name": "s3 bucket public access check",
"owner": "CAS",
"scanner": "IAC",
"severity": "HIGH",
"subCategory": "STORAGE_BUCKETS",
"updatedAt": {
"value": "2024-02-01T00:00:00.000Z"
},
"findingCategory": "Configuration",
"findingDocs": "Custom IaC rule for Public Exposure Storage Buckets",
"mitreTactics": [],
"mitreTechniques": [],
"shortDescription": null,
"complianceStandards": [],
"cspmRuleId": "<cspm-rule-id>",
"cspmTypeId": 60100018
}
}Get a list of all of the Application Security rule labels.
Required license: Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on.
{api_key}
UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP{api_key_id}
241Ok
A list of labels
GET /public_api/appsec/v1/rules/rule-labels HTTP/1.1
Host: api-yourfqdn
Authorization: UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP
x-xdr-auth-id: 241
Accept: */*
Ok
{
"labels": [
"text"
]
}Required license: Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on.
{api_key}
UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP{api_key_id}
241Name of the configured Infrastructure as Code (IaC) framework for this rule definition. Note: Applicable only when scanner is set to IAC.
TERRAFORMPossible values: Ok
POST /public_api/appsec/v1/rules/validate HTTP/1.1
Host: api-yourfqdn
Authorization: UCoWpG4rkNzgCp2dsh8m02iVpZsskwKHz7N1tErPcUV3Wmf59Gc9kytmgOv0pDWoem3PBlORyRIPiir4OcYdWUOWAM3JyTgoCxQf4nQoTlKmFRKz9Bj5vIjluw66p9WP
x-xdr-auth-id: 241
Content-Type: application/json
Accept: */*
Content-Length: 47
[
{
"framework": "TERRAFORM",
"definition": "text"
}
]Ok
{
"frameworksErrors": [
{
"framework": "TERRAFORM",
"errors": [
"text"
]
}
]
}Last updated
Was this helpful?