AppSec Commands
createAppSecPolicy
Creates an Application Security policy with the specified conditions, scope, and triggers.
Arguments
Arguments
policy_name
A unique, descriptive name for the AppSec policy.
Required
description
A detailed explanation of the policy's objective, use case, and expected outcomes.
Optional
asset_group_names
A comma-separated list of asset group names to apply the policy to. The names are automatically resolved to their corresponding IDs. Cannot be combined with scope arguments; when provided, the scope arguments are ignored.
Optional
suggestion_id
The ID of a policy suggestion to associate with this policy, linking the created policy to the AI-generated suggestion it was based on.
Optional
conditions_finding_type
A comma-separated list of finding types to target. When omitted, all finding types except CI/CD Risk are targeted. Possible values are: Vulnerabilities, IaC Misconfiguration, Licenses, Operational Risk, Secrets, Code Weaknesses, CI/CD Risks.
Optional
conditions_severity
A comma-separated list of severity levels to filter findings by. Possible values are: CRITICAL, HIGH, MEDIUM, LOW.
Optional
conditions_respect_developer_suppression
Whether a developer's manual suppression should be honored. When true, only non-suppressed findings are evaluated. Possible values are: true, false.
Optional
conditions_backlog_status
The backlog workflow status to filter findings by. Possible values are: NEW, BACKLOG.
Optional
conditions_package_name
The software package name to target for license or vulnerability policies.
Optional
conditions_package_version
The software package version constraint to target for precise policy targeting.
Optional
conditions_package_operational_risk
The operational risk assessment level to filter packages by. Possible values are: HIGH, MEDIUM, LOW.
Optional
conditions_appsec_rule_names
A comma-separated list of AppSec rule names to include in policy evaluation. The names are automatically resolved to their corresponding IDs.
Optional
conditions_cvss
The CVSS base score threshold for vulnerability findings (0.0-10.0). Only vulnerabilities meeting or exceeding this score trigger the policy.
Optional
conditions_epss
The Exploit Prediction Scoring System score threshold (0-100) to target vulnerabilities with a higher exploitation probability.
Optional
conditions_has_a_fix
Whether to filter findings based on whether a remediation fix or patch is available. Possible values are: true, false.
Optional
conditions_is_kev
Whether to target findings listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. Possible values are: true, false.
Optional
conditions_secret_validity
A comma-separated list of secret validity statuses to filter exposed secrets by. Possible values are: VALID, PRIVILEGED, INVALID, UNAVAILABLE.
Optional
conditions_license_type
A comma-separated list of software license types to target for compliance and legal risk management.
Optional
scope_category
A comma-separated list of asset categories to include in the policy scope. Possible values are: Application, Repository, CI/CD Instance, CI/CD Pipeline, VCS Collaborator, VCS Organization.
Optional
scope_business_application_names
A comma-separated list of business application names to target for focused policy enforcement.
Optional
scope_application_business_criticality
A comma-separated list of business criticality levels to filter applications by. Possible values are: CRITICAL, HIGH, MEDIUM, LOW.
Optional
scope_repository_name
A comma-separated list of code repository names to target for repository-focused policies.
Optional
scope_is_public_repository
Whether to filter repositories based on their visibility (public versus private). Possible values are: true, false.
Optional
scope_has_deployed_assets
Whether to target repositories or applications that have associated deployed infrastructure or runtime assets. Possible values are: true, false.
Optional
scope_has_internet_exposed_deployed_assets
Whether to filter assets based on whether their deployed components are exposed to internet traffic. Possible values are: true, false.
Optional
scope_has_sensitive_data_access
Whether to target deployed assets that have access to sensitive data stores or classified information. Possible values are: true, false.
Optional
scope_has_privileged_capabilities
Whether to filter deployed assets with elevated privileges, admin access, or high-impact system capabilities. Possible values are: true, false.
Optional
triggers_periodic_enabled
Whether to enable the periodic (scheduled-scan) trigger for this policy. When false or omitted, the periodic trigger is sent as a disabled default. Possible values are: true, false.
Optional
triggers_periodic_report_issue
Whether to create an issue when a violation is found during a periodic scan. Possible values are: true, false.
Optional
triggers_periodic_override_severity
The severity level to override for issues created by periodic scan detections. Possible values are: Critical, High, Medium, Low.
Optional
triggers_pr_enabled
Whether to enable the pull-request trigger for this policy. When false or omitted, the PR trigger is sent as a disabled default. Possible values are: true, false.
Optional
triggers_pr_report_issue
Whether to create an issue when a violation is found during a pull request scan. Possible values are: true, false.
Optional
triggers_pr_block_pr
Whether to block merging of pull requests that contain violations detected by the policy. Possible values are: true, false.
Optional
triggers_pr_report_pr_comment
Whether to add an automated comment to pull requests summarizing detected violations and guidance. Possible values are: true, false.
Optional
triggers_pr_override_severity
The severity level to override for issues created by pull request detections. Possible values are: Critical, High, Medium, Low.
Optional
triggers_cicd_enabled
Whether to enable the CI/CD-pipeline trigger for this policy. When false or omitted, the CI/CD trigger is sent as a disabled default. Possible values are: true, false.
Optional
triggers_cicd_report_issue
Whether to create an issue when a violation is found during a CI/CD pipeline scan. Possible values are: true, false.
Optional
triggers_cicd_block_cicd
Whether to block or fail CI/CD pipeline runs when violations occur. Possible values are: true, false.
Optional
triggers_cicd_report_cicd
Whether to report violation details back to the CI/CD system (pipeline logs, dashboards, status checks). Possible values are: true, false.
Optional
triggers_cicd_override_severity
The severity level to override for issues created by CI/CD pipeline detections. Possible values are: Critical, High, Medium, Low.
Optional
triggers_ciimage_enabled
Whether to enable the CI image trigger for this policy. When false or omitted, the CI image trigger is sent as a disabled default. Possible values are: true, false.
Optional
triggers_ciimage_report_issue
Whether to create an issue when a violation is found during a CI image scan. Possible values are: true, false.
Optional
triggers_ciimage_block_cicd
Whether to block or fail CI/CD runs when violations are found in a CI image scan. Possible values are: true, false.
Optional
triggers_ciimage_report_cicd
Whether to report CI image violation details back to the CI/CD system (logs, dashboards, status checks). Possible values are: true, false.
Optional
triggers_ciimage_override_severity
The severity level to override for issues created by CI image detections. Possible values are: Critical, High, Medium, Low.
Optional
triggers_imageregistry_enabled
Whether to enable the image-registry trigger for this policy. When false or omitted, the image-registry trigger is sent as a disabled default. Possible values are: true, false.
Optional
triggers_imageregistry_report_issue
Whether to create an issue when a violation is found during an image-registry scan. Possible values are: true, false.
Optional
triggers_imageregistry_override_severity
The severity level to override for issues created by image-registry detections. Possible values are: Critical, High, Medium, Low.
Optional
Outputs
There are no outputs for this command.
getAppSecIssues
Returns a list of application-security issues based on the provided filter criteria.
Arguments
Arguments
issue_categories
A comma-separated list of issue categories to filter by. If not specified, all applicable issue categories are queried based on the provided filters. Possible values are: vulnerabilities, secrets, iac, weaknesses, operational_risk, licenses, cicd.
Optional
limit
The maximum number of issues to return. Default is 50.
Optional
all_results
Whether to return all results. If true, overrides the 'limit' argument. Possible values are: true, false. Default is false.
Optional
sort_field
The order in which to sort the results. Possible values are: DESC, ASC. Default is DESC.
Optional
sort_order
The order in which to sort the results. Possible values are: DESC, ASC. Default is DESC.
Optional
start_time
The start time for filtering according to the issue insert time. Supports free-text relative and absolute times. For example: '7 days ago', '2023-06-15T10:30:00Z'.
Optional
end_time
The end time for filtering according to the issue insert time. Supports free-text relative and absolute times. For example: '7 days ago', '2023-06-15T10:30:00Z'.
Optional
issue_ids
A comma-separated list of issue IDs to filter by.
Optional
assignees
A comma-separated list of emails of the users assigned to the issue. Use 'unassigned' for all unassigned issues or 'assigned' for all assigned issues.
Optional
collaborators
A comma-separated list of collaborators of the issue.
Optional
statuses
A comma-separated list of issue statuses to filter by. Possible values are: New, In Progress, Resolved.
Optional
issue_names
A comma-separated list of issue names to filter by.
Optional
asset_names
A comma-separated list of names of the affected assets to filter by.
Optional
repositories
A comma-separated list of repositories to filter by.
Optional
file_paths
A comma-separated list of file paths to filter by.
Optional
backlog_statuses
A comma-separated list of backlog statuses to filter by. Possible values are: BACKLOG, NEW.
Optional
cvss_score_gte
The minimum CVSS score to filter by.
Optional
epss_score_gte
The minimum EPSS score to filter by.
Optional
has_kev
Whether to filter by vulnerabilities that have a Known Exploited Vulnerability (KEV). Possible values are: true, false.
Optional
severities
A comma-separated list of issue severities to filter by. Possible values are: info, low, medium, high, critical.
Optional
urgencies
A comma-separated list of issue urgencies to filter by. Possible values are: N/A, NOT_URGENT, URGENT, TOP_URGENT.
Optional
automated_fixes_available
A comma-separated list of automated-fix availability values to filter by. Possible values are: true, false.
Optional
slas
A comma-separated list of SLA statuses to filter by. Possible values are: Approaching, On Track, Overdue.
Optional
validations
A comma-separated list of validation statuses to filter by. Possible values are: INVALID, NO_VALIDATION, PRIVILEGED, UNAVAILABLE, VALID.
Optional
Outputs
Outputs
Core.AppsecIssue.InternalID string
The unique identifier of the issue.
Core.AppsecIssue.AssetName string
The name of the affected asset.
Core.AppsecIssue.Severity string
The severity of the issue.
Core.AppsecIssue.EPSSScore number
The EPSS score of the issue.
Core.AppsecIssue.CVSSScore number
The CVSS score of the issue.
Core.AppsecIssue.Assignee string
The user assigned to the issue.
Core.AppsecIssue.IsFixable boolean
Whether an automated fix is available for the issue.
Core.AppsecIssue.IssueName string
The name of the issue.
Core.AppsecIssue.IssueSource string
The source of the issue.
Core.AppsecIssue.IssueCategory string
The category of the issue.
Core.AppsecIssue.IssueDomain string
The domain of the issue.
Core.AppsecIssue.IssueDescription string
The description of the issue.
Core.AppsecIssue.Status string
The status of the issue.
Core.AppsecIssue.TimeAdded number
The time the issue was added.
Core.AppsecIssue.Urgency string
The urgency of the issue.
Core.AppsecIssue.SLAStatus string
The SLA status of the issue.
Core.AppsecIssue.SecretValidation string
The secret validation status of the issue.
Core.AppsecIssue.RepositoryName string
The name of the repository.
Core.AppsecIssue.PackageVersion string
The package version associated with the issue.
Core.AppsecIssue.FixVersions unknown
The versions that fix the issue.
Core.AppsecIssue.RepositoryOrganization string
The organization of the repository.
Core.AppsecIssue.FilePath string
The path of the relevant file.
Core.AppsecIssue.Collaborator string
The collaborator associated with the issue.
Core.AppsecIssue.HasKEV boolean
Whether the issue has a Known Exploited Vulnerability (KEV).
Core.AppsecIssue.BacklogStatus string
The backlog status of the issue.
Core.AppsecIssue.RepositoryIsPublic boolean
Whether the repository is public.
appsecRemediateIssue
Creates automated pull requests to remediate one or more application-security issues.
Arguments
Arguments
issue_ids
A comma-separated list of issue IDs to remediate (maximum 10 per request).
Required
title
A custom title for the generated pull request.
Optional
Outputs
Last updated
Was this helpful?