> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-commands-guide/appsec-commands.md).
# AppSec Commands
* [createAppSecPolicy](#createappsecpolicy)
#### createAppSecPolicy
***
Creates an Application Security policy with the specified conditions, scope, and triggers.
**Arguments**
Arguments
| Argument Name | Description | Required |
| ----------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- |
| policy\_name | A unique, descriptive name for the AppSec policy. | Required |
| description | A detailed explanation of the policy's objective, use case, and expected outcomes. | Optional |
| asset\_group\_names | A comma-separated list of asset group names to apply the policy to. The names are automatically resolved to their corresponding IDs. Cannot be combined with scope arguments; when provided, the scope arguments are ignored. | Optional |
| suggestion\_id | The ID of a policy suggestion to associate with this policy, linking the created policy to the AI-generated suggestion it was based on. | Optional |
| conditions\_finding\_type | A comma-separated list of finding types to target. When omitted, all finding types except CI/CD Risk are targeted. Possible values are: Vulnerabilities, IaC Misconfiguration, Licenses, Operational Risk, Secrets, Code Weaknesses, CI/CD Risks. | Optional |
| conditions\_severity | A comma-separated list of severity levels to filter findings by. Possible values are: CRITICAL, HIGH, MEDIUM, LOW. | Optional |
| conditions\_respect\_developer\_suppression | Whether a developer's manual suppression should be honored. When true, only non-suppressed findings are evaluated. Possible values are: true, false. | Optional |
| conditions\_backlog\_status | The backlog workflow status to filter findings by. Possible values are: NEW, BACKLOG. | Optional |
| conditions\_package\_name | The software package name to target for license or vulnerability policies. | Optional |
| conditions\_package\_version | The software package version constraint to target for precise policy targeting. | Optional |
| conditions\_package\_operational\_risk | The operational risk assessment level to filter packages by. Possible values are: HIGH, MEDIUM, LOW. | Optional |
| conditions\_appsec\_rule\_names | A comma-separated list of AppSec rule names to include in policy evaluation. The names are automatically resolved to their corresponding IDs. | Optional |
| conditions\_cvss | The CVSS base score threshold for vulnerability findings (0.0-10.0). Only vulnerabilities meeting or exceeding this score trigger the policy. | Optional |
| conditions\_epss | The Exploit Prediction Scoring System score threshold (0-100) to target vulnerabilities with a higher exploitation probability. | Optional |
| conditions\_has\_a\_fix | Whether to filter findings based on whether a remediation fix or patch is available. Possible values are: true, false. | Optional |
| conditions\_is\_kev | Whether to target findings listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. Possible values are: true, false. | Optional |
| conditions\_secret\_validity | A comma-separated list of secret validity statuses to filter exposed secrets by. Possible values are: VALID, PRIVILEGED, INVALID, UNAVAILABLE. | Optional |
| conditions\_license\_type | A comma-separated list of software license types to target for compliance and legal risk management. | Optional |
| scope\_category | A comma-separated list of asset categories to include in the policy scope. Possible values are: Application, Repository, CI/CD Instance, CI/CD Pipeline, VCS Collaborator, VCS Organization. | Optional |
| scope\_business\_application\_names | A comma-separated list of business application names to target for focused policy enforcement. | Optional |
| scope\_application\_business\_criticality | A comma-separated list of business criticality levels to filter applications by. Possible values are: CRITICAL, HIGH, MEDIUM, LOW. | Optional |
| scope\_repository\_name | A comma-separated list of code repository names to target for repository-focused policies. | Optional |
| scope\_is\_public\_repository | Whether to filter repositories based on their visibility (public versus private). Possible values are: true, false. | Optional |
| scope\_has\_deployed\_assets | Whether to target repositories or applications that have associated deployed infrastructure or runtime assets. Possible values are: true, false. | Optional |
| scope\_has\_internet\_exposed\_deployed\_assets | Whether to filter assets based on whether their deployed components are exposed to internet traffic. Possible values are: true, false. | Optional |
| scope\_has\_sensitive\_data\_access | Whether to target deployed assets that have access to sensitive data stores or classified information. Possible values are: true, false. | Optional |
| scope\_has\_privileged\_capabilities | Whether to filter deployed assets with elevated privileges, admin access, or high-impact system capabilities. Possible values are: true, false. | Optional |
| triggers\_periodic\_enabled | Whether to enable the periodic (scheduled-scan) trigger for this policy. When false or omitted, the periodic trigger is sent as a disabled default. Possible values are: true, false. | Optional |
| triggers\_periodic\_report\_issue | Whether to create an issue when a violation is found during a periodic scan. Possible values are: true, false. | Optional |
| triggers\_periodic\_override\_severity | The severity level to override for issues created by periodic scan detections. Possible values are: Critical, High, Medium, Low. | Optional |
| triggers\_pr\_enabled | Whether to enable the pull-request trigger for this policy. When false or omitted, the PR trigger is sent as a disabled default. Possible values are: true, false. | Optional |
| triggers\_pr\_report\_issue | Whether to create an issue when a violation is found during a pull request scan. Possible values are: true, false. | Optional |
| triggers\_pr\_block\_pr | Whether to block merging of pull requests that contain violations detected by the policy. Possible values are: true, false. | Optional |
| triggers\_pr\_report\_pr\_comment | Whether to add an automated comment to pull requests summarizing detected violations and guidance. Possible values are: true, false. | Optional |
| triggers\_pr\_override\_severity | The severity level to override for issues created by pull request detections. Possible values are: Critical, High, Medium, Low. | Optional |
| triggers\_cicd\_enabled | Whether to enable the CI/CD-pipeline trigger for this policy. When false or omitted, the CI/CD trigger is sent as a disabled default. Possible values are: true, false. | Optional |
| triggers\_cicd\_report\_issue | Whether to create an issue when a violation is found during a CI/CD pipeline scan. Possible values are: true, false. | Optional |
| triggers\_cicd\_block\_cicd | Whether to block or fail CI/CD pipeline runs when violations occur. Possible values are: true, false. | Optional |
| triggers\_cicd\_report\_cicd | Whether to report violation details back to the CI/CD system (pipeline logs, dashboards, status checks). Possible values are: true, false. | Optional |
| triggers\_cicd\_override\_severity | The severity level to override for issues created by CI/CD pipeline detections. Possible values are: Critical, High, Medium, Low. | Optional |
| triggers\_ciimage\_enabled | Whether to enable the CI image trigger for this policy. When false or omitted, the CI image trigger is sent as a disabled default. Possible values are: true, false. | Optional |
| triggers\_ciimage\_report\_issue | Whether to create an issue when a violation is found during a CI image scan. Possible values are: true, false. | Optional |
| triggers\_ciimage\_block\_cicd | Whether to block or fail CI/CD runs when violations are found in a CI image scan. Possible values are: true, false. | Optional |
| triggers\_ciimage\_report\_cicd | Whether to report CI image violation details back to the CI/CD system (logs, dashboards, status checks). Possible values are: true, false. | Optional |
| triggers\_ciimage\_override\_severity | The severity level to override for issues created by CI image detections. Possible values are: Critical, High, Medium, Low. | Optional |
| triggers\_imageregistry\_enabled | Whether to enable the image-registry trigger for this policy. When false or omitted, the image-registry trigger is sent as a disabled default. Possible values are: true, false. | Optional |
| triggers\_imageregistry\_report\_issue | Whether to create an issue when a violation is found during an image-registry scan. Possible values are: true, false. | Optional |
| triggers\_imageregistry\_override\_severity | The severity level to override for issues created by image-registry detections. Possible values are: Critical, High, Medium, Low. | Optional |
**Outputs**
There are no outputs for this command.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://cortex-docs.paloaltonetworks.com/cortex-commands-guide/appsec-commands.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.