> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-commands-guide/appsec-commands.md).
# AppSec Commands
* [createAppSecPolicy](#createappsecpolicy)
* [getAppSecIssues](#getappsecissues)
* [appsecRemediateIssue](#appsecremediateissue)
#### createAppSecPolicy
***
Creates an Application Security policy with the specified conditions, scope, and triggers.
**Arguments**
Arguments
| Argument Name | Description | Required |
| ----------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- |
| policy\_name | A unique, descriptive name for the AppSec policy. | Required |
| description | A detailed explanation of the policy's objective, use case, and expected outcomes. | Optional |
| asset\_group\_names | A comma-separated list of asset group names to apply the policy to. The names are automatically resolved to their corresponding IDs. Cannot be combined with scope arguments; when provided, the scope arguments are ignored. | Optional |
| suggestion\_id | The ID of a policy suggestion to associate with this policy, linking the created policy to the AI-generated suggestion it was based on. | Optional |
| conditions\_finding\_type | A comma-separated list of finding types to target. When omitted, all finding types except CI/CD Risk are targeted. Possible values are: Vulnerabilities, IaC Misconfiguration, Licenses, Operational Risk, Secrets, Code Weaknesses, CI/CD Risks. | Optional |
| conditions\_severity | A comma-separated list of severity levels to filter findings by. Possible values are: CRITICAL, HIGH, MEDIUM, LOW. | Optional |
| conditions\_respect\_developer\_suppression | Whether a developer's manual suppression should be honored. When true, only non-suppressed findings are evaluated. Possible values are: true, false. | Optional |
| conditions\_backlog\_status | The backlog workflow status to filter findings by. Possible values are: NEW, BACKLOG. | Optional |
| conditions\_package\_name | The software package name to target for license or vulnerability policies. | Optional |
| conditions\_package\_version | The software package version constraint to target for precise policy targeting. | Optional |
| conditions\_package\_operational\_risk | The operational risk assessment level to filter packages by. Possible values are: HIGH, MEDIUM, LOW. | Optional |
| conditions\_appsec\_rule\_names | A comma-separated list of AppSec rule names to include in policy evaluation. The names are automatically resolved to their corresponding IDs. | Optional |
| conditions\_cvss | The CVSS base score threshold for vulnerability findings (0.0-10.0). Only vulnerabilities meeting or exceeding this score trigger the policy. | Optional |
| conditions\_epss | The Exploit Prediction Scoring System score threshold (0-100) to target vulnerabilities with a higher exploitation probability. | Optional |
| conditions\_has\_a\_fix | Whether to filter findings based on whether a remediation fix or patch is available. Possible values are: true, false. | Optional |
| conditions\_is\_kev | Whether to target findings listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. Possible values are: true, false. | Optional |
| conditions\_secret\_validity | A comma-separated list of secret validity statuses to filter exposed secrets by. Possible values are: VALID, PRIVILEGED, INVALID, UNAVAILABLE. | Optional |
| conditions\_license\_type | A comma-separated list of software license types to target for compliance and legal risk management. | Optional |
| scope\_category | A comma-separated list of asset categories to include in the policy scope. Possible values are: Application, Repository, CI/CD Instance, CI/CD Pipeline, VCS Collaborator, VCS Organization. | Optional |
| scope\_business\_application\_names | A comma-separated list of business application names to target for focused policy enforcement. | Optional |
| scope\_application\_business\_criticality | A comma-separated list of business criticality levels to filter applications by. Possible values are: CRITICAL, HIGH, MEDIUM, LOW. | Optional |
| scope\_repository\_name | A comma-separated list of code repository names to target for repository-focused policies. | Optional |
| scope\_is\_public\_repository | Whether to filter repositories based on their visibility (public versus private). Possible values are: true, false. | Optional |
| scope\_has\_deployed\_assets | Whether to target repositories or applications that have associated deployed infrastructure or runtime assets. Possible values are: true, false. | Optional |
| scope\_has\_internet\_exposed\_deployed\_assets | Whether to filter assets based on whether their deployed components are exposed to internet traffic. Possible values are: true, false. | Optional |
| scope\_has\_sensitive\_data\_access | Whether to target deployed assets that have access to sensitive data stores or classified information. Possible values are: true, false. | Optional |
| scope\_has\_privileged\_capabilities | Whether to filter deployed assets with elevated privileges, admin access, or high-impact system capabilities. Possible values are: true, false. | Optional |
| triggers\_periodic\_enabled | Whether to enable the periodic (scheduled-scan) trigger for this policy. When false or omitted, the periodic trigger is sent as a disabled default. Possible values are: true, false. | Optional |
| triggers\_periodic\_report\_issue | Whether to create an issue when a violation is found during a periodic scan. Possible values are: true, false. | Optional |
| triggers\_periodic\_override\_severity | The severity level to override for issues created by periodic scan detections. Possible values are: Critical, High, Medium, Low. | Optional |
| triggers\_pr\_enabled | Whether to enable the pull-request trigger for this policy. When false or omitted, the PR trigger is sent as a disabled default. Possible values are: true, false. | Optional |
| triggers\_pr\_report\_issue | Whether to create an issue when a violation is found during a pull request scan. Possible values are: true, false. | Optional |
| triggers\_pr\_block\_pr | Whether to block merging of pull requests that contain violations detected by the policy. Possible values are: true, false. | Optional |
| triggers\_pr\_report\_pr\_comment | Whether to add an automated comment to pull requests summarizing detected violations and guidance. Possible values are: true, false. | Optional |
| triggers\_pr\_override\_severity | The severity level to override for issues created by pull request detections. Possible values are: Critical, High, Medium, Low. | Optional |
| triggers\_cicd\_enabled | Whether to enable the CI/CD-pipeline trigger for this policy. When false or omitted, the CI/CD trigger is sent as a disabled default. Possible values are: true, false. | Optional |
| triggers\_cicd\_report\_issue | Whether to create an issue when a violation is found during a CI/CD pipeline scan. Possible values are: true, false. | Optional |
| triggers\_cicd\_block\_cicd | Whether to block or fail CI/CD pipeline runs when violations occur. Possible values are: true, false. | Optional |
| triggers\_cicd\_report\_cicd | Whether to report violation details back to the CI/CD system (pipeline logs, dashboards, status checks). Possible values are: true, false. | Optional |
| triggers\_cicd\_override\_severity | The severity level to override for issues created by CI/CD pipeline detections. Possible values are: Critical, High, Medium, Low. | Optional |
| triggers\_ciimage\_enabled | Whether to enable the CI image trigger for this policy. When false or omitted, the CI image trigger is sent as a disabled default. Possible values are: true, false. | Optional |
| triggers\_ciimage\_report\_issue | Whether to create an issue when a violation is found during a CI image scan. Possible values are: true, false. | Optional |
| triggers\_ciimage\_block\_cicd | Whether to block or fail CI/CD runs when violations are found in a CI image scan. Possible values are: true, false. | Optional |
| triggers\_ciimage\_report\_cicd | Whether to report CI image violation details back to the CI/CD system (logs, dashboards, status checks). Possible values are: true, false. | Optional |
| triggers\_ciimage\_override\_severity | The severity level to override for issues created by CI image detections. Possible values are: Critical, High, Medium, Low. | Optional |
| triggers\_imageregistry\_enabled | Whether to enable the image-registry trigger for this policy. When false or omitted, the image-registry trigger is sent as a disabled default. Possible values are: true, false. | Optional |
| triggers\_imageregistry\_report\_issue | Whether to create an issue when a violation is found during an image-registry scan. Possible values are: true, false. | Optional |
| triggers\_imageregistry\_override\_severity | The severity level to override for issues created by image-registry detections. Possible values are: Critical, High, Medium, Low. | Optional |
**Outputs**
There are no outputs for this command.
#### getAppSecIssues
***
Returns a list of application-security issues based on the provided filter criteria.
**Arguments**
Arguments
| Argument Name | Description | Required |
| --------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- |
| issue\_categories | A comma-separated list of issue categories to filter by. If not specified, all applicable issue categories are queried based on the provided filters. Possible values are: vulnerabilities, secrets, iac, weaknesses, operational\_risk, licenses, cicd. | Optional |
| limit | The maximum number of issues to return. Default is 50. | Optional |
| all\_results | Whether to return all results. If true, overrides the 'limit' argument. Possible values are: true, false. Default is false. | Optional |
| sort\_field | The order in which to sort the results. Possible values are: DESC, ASC. Default is DESC. | Optional |
| sort\_order | The order in which to sort the results. Possible values are: DESC, ASC. Default is DESC. | Optional |
| start\_time | The start time for filtering according to the issue insert time. Supports free-text relative and absolute times. For example: '7 days ago', '2023-06-15T10:30:00Z'. | Optional |
| end\_time | The end time for filtering according to the issue insert time. Supports free-text relative and absolute times. For example: '7 days ago', '2023-06-15T10:30:00Z'. | Optional |
| issue\_ids | A comma-separated list of issue IDs to filter by. | Optional |
| assignees | A comma-separated list of emails of the users assigned to the issue. Use 'unassigned' for all unassigned issues or 'assigned' for all assigned issues. | Optional |
| collaborators | A comma-separated list of collaborators of the issue. | Optional |
| statuses | A comma-separated list of issue statuses to filter by. Possible values are: New, In Progress, Resolved. | Optional |
| issue\_names | A comma-separated list of issue names to filter by. | Optional |
| asset\_names | A comma-separated list of names of the affected assets to filter by. | Optional |
| repositories | A comma-separated list of repositories to filter by. | Optional |
| file\_paths | A comma-separated list of file paths to filter by. | Optional |
| backlog\_statuses | A comma-separated list of backlog statuses to filter by. Possible values are: BACKLOG, NEW. | Optional |
| cvss\_score\_gte | The minimum CVSS score to filter by. | Optional |
| epss\_score\_gte | The minimum EPSS score to filter by. | Optional |
| has\_kev | Whether to filter by vulnerabilities that have a Known Exploited Vulnerability (KEV). Possible values are: true, false. | Optional |
| severities | A comma-separated list of issue severities to filter by. Possible values are: info, low, medium, high, critical. | Optional |
| urgencies | A comma-separated list of issue urgencies to filter by. Possible values are: N/A, NOT\_URGENT, URGENT, TOP\_URGENT. | Optional |
| automated\_fixes\_available | A comma-separated list of automated-fix availability values to filter by. Possible values are: true, false. | Optional |
| slas | A comma-separated list of SLA statuses to filter by. Possible values are: Approaching, On Track, Overdue. | Optional |
| validations | A comma-separated list of validation statuses to filter by. Possible values are: INVALID, NO\_VALIDATION, PRIVILEGED, UNAVAILABLE, VALID. | Optional |
**Outputs**
Outputs
**Core.AppsecIssue.InternalID** *string*
The unique identifier of the issue.
**Core.AppsecIssue.AssetName** *string*
The name of the affected asset.
**Core.AppsecIssue.Severity** *string*
The severity of the issue.
**Core.AppsecIssue.EPSSScore** *number*
The EPSS score of the issue.
**Core.AppsecIssue.CVSSScore** *number*
The CVSS score of the issue.
**Core.AppsecIssue.Assignee** *string*
The user assigned to the issue.
**Core.AppsecIssue.IsFixable** *boolean*
Whether an automated fix is available for the issue.
**Core.AppsecIssue.IssueName** *string*
The name of the issue.
**Core.AppsecIssue.IssueSource** *string*
The source of the issue.
**Core.AppsecIssue.IssueCategory** *string*
The category of the issue.
**Core.AppsecIssue.IssueDomain** *string*
The domain of the issue.
**Core.AppsecIssue.IssueDescription** *string*
The description of the issue.
**Core.AppsecIssue.Status** *string*
The status of the issue.
**Core.AppsecIssue.TimeAdded** *number*
The time the issue was added.
**Core.AppsecIssue.Urgency** *string*
The urgency of the issue.
**Core.AppsecIssue.SLAStatus** *string*
The SLA status of the issue.
**Core.AppsecIssue.SecretValidation** *string*
The secret validation status of the issue.
**Core.AppsecIssue.RepositoryName** *string*
The name of the repository.
**Core.AppsecIssue.PackageVersion** *string*
The package version associated with the issue.
**Core.AppsecIssue.FixVersions** *unknown*
The versions that fix the issue.
**Core.AppsecIssue.RepositoryOrganization** *string*
The organization of the repository.
**Core.AppsecIssue.FilePath** *string*
The path of the relevant file.
**Core.AppsecIssue.Collaborator** *string*
The collaborator associated with the issue.
**Core.AppsecIssue.HasKEV** *boolean*
Whether the issue has a Known Exploited Vulnerability (KEV).
**Core.AppsecIssue.BacklogStatus** *string*
The backlog status of the issue.
**Core.AppsecIssue.RepositoryIsPublic** *boolean*
Whether the repository is public.
#### appsecRemediateIssue
***
Creates automated pull requests to remediate one or more application-security issues.
**Arguments**
Arguments
| Argument Name | Description | Required |
| ------------- | -------------------------------------------------------------------------- | -------- |
| issue\_ids | A comma-separated list of issue IDs to remediate (maximum 10 per request). | Required |
| title | A custom title for the generated pull request. | Optional |
**Outputs**
Outputs
**Core.TriggeredPRs.IssueID** *string*
The issue identifier.
**Core.TriggeredPRs.Status** *string*
The PR status: "triggered" or "automated\_fix\_not\_available".
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://cortex-docs.paloaltonetworks.com/cortex-commands-guide/appsec-commands.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.