> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xdr-5-api/aspm-cicd-and-application-security/rules.md).

# Rules

APIs for managing rules

## Get AppSec rules

> Get a paginated list of Application Security (AppSec) rules. Supports filtering by enabled state, custom flag, categories, sub-categories, cloud providers, scanners, severities, frameworks, and labels.\
> \
> \*\*Required license:\*\* Cortex XDR with the Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security Add-on.

```json
{"openapi":"3.0.0","info":{"title":"ASPM, CICD and Application Security APIs","version":"Cortex XDR 5.2"},"tags":[{"name":"Rules","description":"APIs for managing rules"}],"servers":[{"url":"https://api-yourfqdn"}],"security":[],"paths":{"/public_api/appsec/v1/rules":{"get":{"tags":["Rules"],"summary":"Get AppSec rules","description":"Get a paginated list of Application Security (AppSec) rules. Supports filtering by enabled state, custom flag, categories, sub-categories, cloud providers, scanners, severities, frameworks, and labels.\n\n**Required license:** Cortex XDR with the Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security Add-on.","operationId":"GetRules","parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true},{"name":"get-scanner-rule-id","description":"Unique identifier for a scanner rule. When set to `true`, the `scannerRuleId` field is included in each rule object returned in the response. If omitted or set to `false`, the `scannerRuleId` field is excluded from the response. ","in":"header","required":false,"schema":{"type":"boolean"}},{"name":"enabled","in":"query","description":"Filter rules by their enabled state. Set to `true` to return only active rules, or `false` to return only disabled rules. If omitted, rules of both states are returned.","required":false,"schema":{"type":"boolean"}},{"name":"isCustom","in":"query","required":false,"schema":{"type":"boolean"},"description":"Filter rules by type. Set to `true` to return only custom rules, or `false` to return only out-of-the-box rules. If omitted, both rule types are returned."},{"name":"categories","in":"query","deprecated":false,"allowEmptyValue":false,"explode":false,"schema":{"type":"array","items":{"type":"string","enum":["AI_ML","LOGGING","KUBERNETES","COMPUTE","STORAGE","PUBLIC","NETWORKING","MONITORING","IAM","API_KEYS","DATABASE_CREDENTIALS","ENCRYPTION_KEYS","CLOUD_SERVICE_PROVIDER_KEYS","SSH_KEYS","ENVIRONMENT_VARIABLES","SENSITIVE_TOKENS","THIRD_PARTY_SERVICES"]}},"description":"Custom AppSec rule category."},{"name":"subCategories","in":"query","schema":{"type":"array","items":{"type":"string"}},"description":"Filter rules by subcategory. Subcategories further classify the type of security issue within a category and are applicable to `IAC` rules only. The supported subcategory values depend on the selected categories filter. `CICD`, `SCA`, and `SECRETS` rules do not have subcategories and are retured with a `null` value."},{"name":"cloudProviders","in":"query","schema":{"type":"array","items":{"type":"string","enum":["ALIBABA_CLOUD","AWS","AZURE","GCP","IBM","ORACLE","OTHER"]}},"description":"Cloud provider associated with the rule. "},{"name":"scanners","in":"query","description":"Filter rules by the type of security scanner used to detect findings.","required":false,"schema":{"type":"array","items":{"type":"string","$ref":"#/components/schemas/Scanner"}}},{"name":"severities","in":"query","description":"The priority level assigned to findings identified by the rule","required":false,"schema":{"type":"array","items":{"$ref":"#/components/schemas/Severity"}}},{"name":"frameworks","in":"query","description":"Filter rules by the IaC framework or language they apply to. Returns only rules that have a definition for at least one of the specified frameworks.","required":false,"schema":{"type":"array","items":{"$ref":"#/components/schemas/FrameworkName"}}},{"name":"labels","in":"query","description":"Filter rules by one or more labels. Returns only rules that have all specified labels assigned.","required":false,"schema":{"type":"array","items":{"type":"string"}}},{"name":"offset","description":"The number of rules to skip before returning results. Used for pagination together with `limit`. Set to 0 to start from the first result.","in":"query","required":false,"schema":{"type":"number","format":"double","default":0}},{"name":"limit","description":"The maximum number of rules to return per page. Used for pagination together with `offset`.","in":"query","required":false,"schema":{"type":"number","format":"double","default":100}},{"name":"sortBy","description":"The field by which to sort the returned rules.","in":"query","required":false,"schema":{"type":"string","enum":["created_at","name","labels"],"default":"name"}},{"name":"sortOrder","in":"query","required":false,"schema":{"$ref":"#/components/schemas/SortDirection"},"description":"The sort direction for the results. Use `1` for ascending order and `-1` for descending order."}],"responses":{"200":{"description":"Ok","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GetRulesResponseObject"}}}}}}}},"components":{"schemas":{"Scanner":{"type":"string","enum":["CICD","IAC","SCA","SECRETS"],"description":"The scanner type used by this rule to detect security issues."},"Severity":{"type":"string","enum":["CRITICAL","HIGH","INFO","LOW","MEDIUM"],"title":"Severity","description":"Severity level of the rule"},"FrameworkName":{"type":"string","enum":["ARM","BICEP","CLOUDFORMATION","KUBERNETES","TERRAFORM"],"title":"FrameworkName","description":"Name of the configured Infrastructure as Code (IaC) framework for this rule definition. **Note:** Applicable only when `scanner` is set to `IAC`."},"SortDirection":{"type":"integer","enum":[-1,1]},"GetRulesResponseObject":{"type":"object","title":"GetRulesResponseObject","properties":{"offset":{"type":"number","description":"The starting position of the current page of results."},"nextOffset":{"type":"number","description":"The offset to use in the next request to retrieve the next page of results. Returns `null` if there are no more results.","nullable":true},"rules":{"type":"array","items":{"$ref":"#/components/schemas/DetectionRule"}}}},"DetectionRule":{"type":"object","title":"DetectionRule","description":"Details of the Application Security rule","properties":{"category":{"type":"string","description":"Custom Appsec rule category."},"cloudProvider":{"$ref":"#/components/schemas/CloudProvider"},"createdAt":{"type":"string","format":"date-time","description":"The timestamp when the AppSec rule was created."},"description":{"type":"string","description":"The rule description."},"shortDescription":{"type":"string","description":"A brief summary of the rule. If not provided, this field is null.","nullable":true},"detectionMethod":{"type":"string","description":"Security scanner used to detect findings for this rule."},"docLink":{"type":"string","description":"A URL linking to the relevant Cortex Cloud documentation page."},"domain":{"type":"string","description":"The domain associated with the rule."},"findingCategory":{"$ref":"#/components/schemas/FindingCategory"},"findingDocs":{"type":"string"},"findingTypeId":{"type":"number","format":"double","description":"The numeric identifier of the finding type associated with this rule. "},"findingTypeName":{"type":"string","description":"Display name of the finding type associated with this rule. Matches the rule `name` for custom rules."},"frameworks":{"type":"array","items":{"$ref":"#/components/schemas/Frameworks"}},"id":{"type":"string","description":"Unique identifier of the AppSec rule."},"isCustom":{"type":"boolean","description":"Indicates whether the rule is a custom rule created by the user (true) or an out-of-the-box rule (false)."},"isEnabled":{"type":"boolean","description":"Indicates whether the rule is currently active and will generate findings during scans."},"labels":{"type":"array","description":"Labels assigned to the rule.","items":{"type":"string"}},"updatedAt":{"type":"string","format":"date-time","description":"The timestamp when the AppSec rule was last modified."},"mitreTactics":{"type":"array","description":"The MITRE ATT&CK tactic identifiers associated with this rule. Returns an empty array if no tactics are mapped.","nullable":true,"items":{"type":"string"}},"mitreTechniques":{"type":"array","description":"The MITRE ATT&CK technique identifiers associated with this rule. Returns an empty array if no techniques are mapped.","nullable":true,"items":{"type":"string"}},"name":{"type":"string","description":"Name of the Appsec rule."},"owner":{"type":"string","description":"The internal service owner of the rule."},"scanner":{"$ref":"#/components/schemas/Scanner"},"severity":{"$ref":"#/components/schemas/Severity"},"subCategory":{"type":"string","description":"Custom rule subcategory."},"complianceStandards":{"$ref":"#/components/schemas/ComplianceStandard"},"cspmRuleId":{"type":"string","description":"The ID of the mapped Cloud Security rule. When set, findings from this AppSec rule are correlated with the corresponding Cloud Security rule. Returns `null` if no rule is mapped.","nullable":true},"cspmTypeId":{"type":"number","description":"The numeric type identifier of the mapped Cloud Security rule. Returned only when the AppSec rule is linked to a rule via `cspmRuleId`.","nullable":true}}},"CloudProvider":{"type":"string","enum":["ALIBABA_CLOUD","AWS","Azure","GCP","IBM","ORACLE","OTHER"],"description":"The cloud provider associated with the rule. If the rule is not cloud-provider-specific, this field is null."},"FindingCategory":{"type":"string","enum":["Code","Configuration","Data","Vulnerability"],"description":"Category of findings this rule generates."},"Frameworks":{"type":"object","properties":{"frameworkDetails":{"nullable":true,"allOf":[{"$ref":"#/components/schemas/FrameworkDetails"}]}},"description":"Framework objects containing the rule definition and remediation details for each supported IaC framework or secrets detection framework. "},"FrameworkDetails":{"type":"object","properties":{"definition":{"type":"string","description":"The rule definition.","nullable":true},"definition_link":{"type":"string","description":"**http** link to the definition documentation.","nullable":true},"name":{"$ref":"#/components/schemas/FrameworkName"},"remediation_description":{"type":"string","description":"The remediation steps that will appear on the Appsec rule's findings.","nullable":true},"remediation_ids":{"type":"array","description":"The IDs of related remediation resources.","nullable":true,"items":{"type":"string"}},"resource_types":{"type":"array","description":"The resource types associated with the rule.","nullable":true,"items":{"type":"string"}}}},"ComplianceStandard":{"type":"object","additionalProperties":false,"description":"An array of compliance standards associated with this rule.","properties":{"standardName":{"type":"string","description":"The name of the compliance framework or standard that this rule is mapped to. "},"controls":{"type":"array","items":{"$ref":"#/components/schemas/Control"}}}},"Control":{"type":"object","additionalProperties":false,"description":"An array of individual controls within the compliance standard that this rule satisfies. ","required":["controlName","controlDefinition"],"properties":{"controlName":{"type":"string","description":"The name or identifier of the compliance control."},"controlDefinition":{"type":"string","description":"A description of what the compliance control requires or validates. "}}}}}}
```

## Create an AppSec rule

> Create a new Application Security Rule. Application Security rules are designed to detect security threats within your application security environment. Application Security rules identify and flag issues based on predefined criteria.\
> \
> \*\*Limitation\*\*: This API supports creating custom rules only for \*\*IaC Security\*\* and \*\*Secrets Security\*\*. CI/CD Security custom rules are \*\*not\*\* supported.\
> \
> \*\*Required license:\*\* Cortex XDR with the Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security Add-on.

```json
{"openapi":"3.0.0","info":{"title":"ASPM, CICD and Application Security APIs","version":"Cortex XDR 5.2"},"tags":[{"name":"Rules","description":"APIs for managing rules"}],"servers":[{"url":"https://api-yourfqdn"}],"security":[],"paths":{"/public_api/appsec/v1/rules":{"post":{"tags":["Rules"],"summary":"Create an AppSec rule","description":"Create a new Application Security Rule. Application Security rules are designed to detect security threats within your application security environment. Application Security rules identify and flag issues based on predefined criteria.\n\n**Limitation**: This API supports creating custom rules only for **IaC Security** and **Secrets Security**. CI/CD Security custom rules are **not** supported.\n\n**Required license:** Cortex XDR with the Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security Add-on.","operationId":"CreateCustomRule","parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/CreateOrModifyCustomRuleRequestParams"}}}},"responses":{"201":{"description":"Created. A new resource was created successfully.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DetectionRule"}}}},"400":{"description":"Bad Request","content":{"application/json":{"schema":{"type":"object","properties":{"errorCode":{"type":"string","description":"The HTTP error category. Indicates the general type of error that occurred."},"message":{"type":"string","description":"A human-readable message with specific details about why the request failed."}}}}}}}}}},"components":{"schemas":{"CreateOrModifyCustomRuleRequestParams":{"type":"object","title":"CreateOrModifyCustomRuleRequestParams","description":"Define the Application Security custom rule. The `category` option should match your selection for `scanner`.","additionalProperties":false,"required":["name","severity","scanner","frameworks","category","subCategory"],"properties":{"name":{"type":"string","description":"A unique name for the Appsec rule."},"description":{"type":"string","description":"Description of the rule"},"severity":{"$ref":"#/components/schemas/Severity"},"labels":{"type":"array","description":"Labels to be assigned to the rule","items":{"type":"string"}},"scanner":{"$ref":"#/components/schemas/CustomRuleScanner"},"frameworks":{"$ref":"#/components/schemas/FrameworkRequestParams"},"category":{"anyOf":[{"$ref":"#/components/schemas/CustomRuleIacCategory"},{"$ref":"#/components/schemas/CustomRuleSecretsCategory"}]},"subCategory":{"$ref":"#/components/schemas/CustomRuleIacSubCategory"},"cspmRuleId":{"type":"string","description":"The unique identifier of the Cloud Security rule to which the custom Application Security rule will be mapped. Applicable only when `scanner` is set to `IAC`.","nullable":true},"clonedFromRuleId":{"type":"string","description":"Optional. ID of the source rule from which this rule was cloned. This field is present only for cloned rules.","nullable":true}}},"Severity":{"type":"string","enum":["CRITICAL","HIGH","INFO","LOW","MEDIUM"],"title":"Severity","description":"Severity level of the rule"},"CustomRuleScanner":{"title":"CustomRuleScanner","description":"The type of security scanner used to detect findings of this rule. Choose any one of the scanners.","enum":["IAC","SECRETS"],"type":"string"},"FrameworkRequestParams":{"type":"object","title":"FrameworkRequestParams","additionalProperties":false,"required":["name","definition"],"properties":{"name":{"$ref":"#/components/schemas/FrameworkName"},"definition":{"type":"string","description":"The rule definition\n\nIaC example:\n`definition:\\n cond_type: attribute\\n resource_types:\\n - aws_s3_bucket_public_access_block\\n attribute: block_public_acls\\n operator: equals\\n value: false`\n\nSecrets example:\n`definition:\\n cond_type: secrets\\n value: AIza[0-9A-Za-z-_]{35}`\n","nullable":true},"definitionLink":{"type":"string","description":"**http** link to the definition documentation.","nullable":true},"remediationDescription":{"type":"string","description":"The remediation steps that will appear on the Appsec rule's findings.\n\nIaC Example: Set block_public_acls to true in aws_s3_bucket_public_access_block resource\n\nSecrets Example: Revoke the GCP API key immediately through the Google Cloud Console.","nullable":true}}},"FrameworkName":{"type":"string","enum":["ARM","BICEP","CLOUDFORMATION","KUBERNETES","TERRAFORM"],"title":"FrameworkName","description":"Name of the configured Infrastructure as Code (IaC) framework for this rule definition. **Note:** Applicable only when `scanner` is set to `IAC`."},"CustomRuleIacCategory":{"type":"string","enum":["AI_ML","COMPUTE","IAM","KUBERNETES","LOGGING","MONITORING","NETWORKING","PUBLIC","STORAGE"],"title":"CustomRuleIacCategory","description":"Custom rule IaC category. Applicable only when `scanner` is set to `IAC`."},"CustomRuleSecretsCategory":{"type":"string","enum":["API_KEYS","DATABASE_CREDENTIALS","ENCRYPTION_KEYS","CLOUD_SERVICE_PROVIDER_KEYS","SSH_KEYS","ENVIRONMENT_VARIABLES","SENSITIVE_TOKENS","THIRD_PARTY_SERVICES"],"title":"CustomRuleSecretsCategory","description":"Custom rule secret category. Applicable only when `scanner` is set to `SECRETS`."},"CustomRuleIacSubCategory":{"type":"string","enum":["GUARDRAILS","RISKY_MODELS","PUBLIC_EXPOSURE","PERMISSIONS","ENCRYPTION","RETENTION","FORMATS","DISABLED_OR_MISSING","UNDER_USE","NETWORK_POLICIES","ACCESS_CONTROL","LOGGING_AND_MONITORING","RESOURCE_MANAGEMENT","NATIVE_SECURITY_CONTROLS","MANAGEMENT_SERVICES_EXPOSURE","OVERPROVISIONED","STARTUP_SCRIPT_LEAKS","DEFAULT_CREDENTIALS_OR_AUTH","UNSANCTIONED_RESOURCE_OR_TYPE","BACKUPS","VERSIONING","REPLICATION","ALERTING","REDUNDANCY","ADMIN_INTERFACES","DATABASE_ENDPOINTS","STORAGE_BUCKETS","APIS","SENSITIVE_PORTS","LOAD_BALANCING","INGRESS_CONTROLS","EGRESS_CONTROLS","ENCRYPTION_AND_PROTOCOLS","VPC_VCN_VNET","FLOW_LOGS","TAGS_AND_METADATA","RESOURCE_HEALTH","PERFORMANCE_MONITORING","ALERTING_AND_NOTIFICATIONS","UNINTEGRATED","STORAGE","OVERLY_PERMISSIVE","UNUSED","CREDENTIAL_EXPOSURE","MFA","ROLE_SEPARATION","SHARED","EXPIRED_KEY_CONTROLS","AUTHENTICATION_POLICIES"],"title":"CustomRuleIacSubCategory","description":"Custom rule subcategory. The supported values depend on the selected category. Refer to the following table for the valid subcategories for each category.\n\nNote: This field is applicable only when `scanner` is set to `IAC`.\n\n## Category and Subcategory Table for IaC Scanner\n\n| Category | Subcategory |\n|----------|-------------|\n| AI and Machine Learning (`AI_ML`) | Guardrails (`GUARDRAILS`) |\n| AI and Machine Learning (`AI_ML`) | Risky models (`RISKY_MODELS`) |\n| AI and Machine Learning (`AI_ML`) | Public Exposure (`PUBLIC_EXPOSURE`) |\n| AI and Machine Learning (`AI_ML`) | Permissions (`PERMISSIONS`) |\n| Logging (`LOGGING`) | Encryption (`ENCRYPTION`) |\n| Logging (`LOGGING`) | Permissions (`PERMISSIONS`) |\n| Logging (`LOGGING`) | Retention (`RETENTION`) |\n| Logging (`LOGGING`) | Formats (`FORMATS`) |\n| Logging (`LOGGING`) | Disabled or missing (`DISABLED_OR_MISSING`) |\n| Logging (`LOGGING`) | Public Exposure (`PUBLIC_EXPOSURE`) |\n| Logging (`LOGGING`) | Under Use (`UNDER_USE`) |\n| Kubernetes (`KUBERNETES`) | Network Policies (`NETWORK_POLICIES`) |\n| Kubernetes (`KUBERNETES`) | Access Control (`ACCESS_CONTROL`) |\n| Kubernetes (`KUBERNETES`) | Logging and Monitoring (`LOGGING_AND_MONITORING`) |\n| Kubernetes (`KUBERNETES`) | Resource Management (`RESOURCE_MANAGEMENT`) |\n| Kubernetes (`KUBERNETES`) | Native Security Controls (`NATIVE_SECURITY_CONTROLS`) |\n| Kubernetes (`KUBERNETES`) | Management Services Exposure (`MANAGEMENT_SERVICES_EXPOSURE`) |\n| Compute (`COMPUTE`) | Overprovisioned (`OVERPROVISIONED`) |\n| Compute (`COMPUTE`) | Startup Script Leaks (`STARTUP_SCRIPT_LEAKS`) |\n| Compute (`COMPUTE`) | Default Credentials or Auth (`DEFAULT_CREDENTIALS_OR_AUTH`) |\n| Compute (`COMPUTE`) | Unsanctioned Resource or Type (`UNSANCTIONED_RESOURCE_OR_TYPE`) |\n| Storage (`STORAGE`) | Encryption (`ENCRYPTION`) |\n| Storage (`STORAGE`) | Permissions (`PERMISSIONS`) |\n| Storage (`STORAGE`) | Backups (`BACKUPS`) |\n| Storage (`STORAGE`) | Versioning (`VERSIONING`) |\n| Storage (`STORAGE`) | Replication (`REPLICATION`) |\n| Storage (`STORAGE`) | Alerting (`ALERTING`) |\n| Storage (`STORAGE`) | Redundancy (`REDUNDANCY`) |\n| Public (`PUBLIC`) | Admin Interfaces (`ADMIN_INTERFACES`) |\n| Public (`PUBLIC`) | Database Endpoints (`DATABASE_ENDPOINTS`) |\n| Public (`PUBLIC`) | Storage Buckets (`STORAGE_BUCKETS`) |\n| Public (`PUBLIC`) | APIs (`APIS`) |\n| Public (`PUBLIC`) | Sensitive Ports (`SENSITIVE_PORTS`) |\n| Networking (`NETWORKING`) | Load Balancing (`LOAD_BALANCING`) |\n| Networking (`NETWORKING`) | Ingress Controls (`INGRESS_CONTROLS`) |\n| Networking (`NETWORKING`) | Egress Controls (`EGRESS_CONTROLS`) |\n| Networking (`NETWORKING`) | Encryption and Protocols (`ENCRYPTION_AND_PROTOCOLS`) |\n| Networking (`NETWORKING`) | VPC/VCN/VNET (`VPC_VCN_VNET`) |\n| Networking (`NETWORKING`) | Flow Logs (`FLOW_LOGS`) |\n| Monitoring (`MONITORING`) | Tags and metadata (`TAGS_AND_METADATA`) |\n| Monitoring (`MONITORING`) | Resource Health (`RESOURCE_HEALTH`) |\n| Monitoring (`MONITORING`) | Performance Monitoring (`PERFORMANCE_MONITORING`) |\n| Monitoring (`MONITORING`) | Alerting and Notifications (`ALERTING_AND_NOTIFICATIONS`) |\n| Monitoring (`MONITORING`) | Unintegrated (`UNINTEGRATED`) |\n| Monitoring (`MONITORING`) | Storage (`STORAGE`) |\n| IAM (`IAM`) | Overly Permissive (`OVERLY_PERMISSIVE`) |\n| IAM (`IAM`) | Unused (`UNUSED`) |\n| IAM (`IAM`) | Credential Exposure (`CREDENTIAL_EXPOSURE`) |\n| IAM (`IAM`) | MFA (`MFA`) |\n| IAM (`IAM`) | Role Separation (`ROLE_SEPARATION`) |\n| IAM (`IAM`) | Shared (`SHARED`) |\n| IAM (`IAM`) | Expired Key Controls (`EXPIRED_KEY_CONTROLS`) |\n| IAM (`IAM`) | Authentication Policies (`AUTHENTICATION_POLICIES`) |"},"DetectionRule":{"type":"object","title":"DetectionRule","description":"Details of the Application Security rule","properties":{"category":{"type":"string","description":"Custom Appsec rule category."},"cloudProvider":{"$ref":"#/components/schemas/CloudProvider"},"createdAt":{"type":"string","format":"date-time","description":"The timestamp when the AppSec rule was created."},"description":{"type":"string","description":"The rule description."},"shortDescription":{"type":"string","description":"A brief summary of the rule. If not provided, this field is null.","nullable":true},"detectionMethod":{"type":"string","description":"Security scanner used to detect findings for this rule."},"docLink":{"type":"string","description":"A URL linking to the relevant Cortex Cloud documentation page."},"domain":{"type":"string","description":"The domain associated with the rule."},"findingCategory":{"$ref":"#/components/schemas/FindingCategory"},"findingDocs":{"type":"string"},"findingTypeId":{"type":"number","format":"double","description":"The numeric identifier of the finding type associated with this rule. "},"findingTypeName":{"type":"string","description":"Display name of the finding type associated with this rule. Matches the rule `name` for custom rules."},"frameworks":{"type":"array","items":{"$ref":"#/components/schemas/Frameworks"}},"id":{"type":"string","description":"Unique identifier of the AppSec rule."},"isCustom":{"type":"boolean","description":"Indicates whether the rule is a custom rule created by the user (true) or an out-of-the-box rule (false)."},"isEnabled":{"type":"boolean","description":"Indicates whether the rule is currently active and will generate findings during scans."},"labels":{"type":"array","description":"Labels assigned to the rule.","items":{"type":"string"}},"updatedAt":{"type":"string","format":"date-time","description":"The timestamp when the AppSec rule was last modified."},"mitreTactics":{"type":"array","description":"The MITRE ATT&CK tactic identifiers associated with this rule. Returns an empty array if no tactics are mapped.","nullable":true,"items":{"type":"string"}},"mitreTechniques":{"type":"array","description":"The MITRE ATT&CK technique identifiers associated with this rule. Returns an empty array if no techniques are mapped.","nullable":true,"items":{"type":"string"}},"name":{"type":"string","description":"Name of the Appsec rule."},"owner":{"type":"string","description":"The internal service owner of the rule."},"scanner":{"$ref":"#/components/schemas/Scanner"},"severity":{"$ref":"#/components/schemas/Severity"},"subCategory":{"type":"string","description":"Custom rule subcategory."},"complianceStandards":{"$ref":"#/components/schemas/ComplianceStandard"},"cspmRuleId":{"type":"string","description":"The ID of the mapped Cloud Security rule. When set, findings from this AppSec rule are correlated with the corresponding Cloud Security rule. Returns `null` if no rule is mapped.","nullable":true},"cspmTypeId":{"type":"number","description":"The numeric type identifier of the mapped Cloud Security rule. Returned only when the AppSec rule is linked to a rule via `cspmRuleId`.","nullable":true}}},"CloudProvider":{"type":"string","enum":["ALIBABA_CLOUD","AWS","Azure","GCP","IBM","ORACLE","OTHER"],"description":"The cloud provider associated with the rule. If the rule is not cloud-provider-specific, this field is null."},"FindingCategory":{"type":"string","enum":["Code","Configuration","Data","Vulnerability"],"description":"Category of findings this rule generates."},"Frameworks":{"type":"object","properties":{"frameworkDetails":{"nullable":true,"allOf":[{"$ref":"#/components/schemas/FrameworkDetails"}]}},"description":"Framework objects containing the rule definition and remediation details for each supported IaC framework or secrets detection framework. "},"FrameworkDetails":{"type":"object","properties":{"definition":{"type":"string","description":"The rule definition.","nullable":true},"definition_link":{"type":"string","description":"**http** link to the definition documentation.","nullable":true},"name":{"$ref":"#/components/schemas/FrameworkName"},"remediation_description":{"type":"string","description":"The remediation steps that will appear on the Appsec rule's findings.","nullable":true},"remediation_ids":{"type":"array","description":"The IDs of related remediation resources.","nullable":true,"items":{"type":"string"}},"resource_types":{"type":"array","description":"The resource types associated with the rule.","nullable":true,"items":{"type":"string"}}}},"Scanner":{"type":"string","enum":["CICD","IAC","SCA","SECRETS"],"description":"The scanner type used by this rule to detect security issues."},"ComplianceStandard":{"type":"object","additionalProperties":false,"description":"An array of compliance standards associated with this rule.","properties":{"standardName":{"type":"string","description":"The name of the compliance framework or standard that this rule is mapped to. "},"controls":{"type":"array","items":{"$ref":"#/components/schemas/Control"}}}},"Control":{"type":"object","additionalProperties":false,"description":"An array of individual controls within the compliance standard that this rule satisfies. ","required":["controlName","controlDefinition"],"properties":{"controlName":{"type":"string","description":"The name or identifier of the compliance control."},"controlDefinition":{"type":"string","description":"A description of what the compliance control requires or validates. "}}}}}}
```

## Get an AppSec rule

> Get the details of the specified Application Security rule.\
> \
> \*\*Required license:\*\* Cortex XDR with the Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security Add-on.

```json
{"openapi":"3.0.0","info":{"title":"ASPM, CICD and Application Security APIs","version":"Cortex XDR 5.2"},"tags":[{"name":"Rules","description":"APIs for managing rules"}],"servers":[{"url":"https://api-yourfqdn"}],"security":[],"paths":{"/public_api/appsec/v1/rules/{ruleId}":{"get":{"tags":["Rules"],"summary":"Get an AppSec rule","description":"Get the details of the specified Application Security rule.\n\n**Required license:** Cortex XDR with the Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security Add-on.","operationId":"GetRuleById","parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true},{"name":"ruleId","description":"Unique identifier of the Application Security rule","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Ok","content":{"application/json":{"schema":{"$ref":"#/components/schemas/DetectionRule"}}}}}}}},"components":{"schemas":{"DetectionRule":{"type":"object","title":"DetectionRule","description":"Details of the Application Security rule","properties":{"category":{"type":"string","description":"Custom Appsec rule category."},"cloudProvider":{"$ref":"#/components/schemas/CloudProvider"},"createdAt":{"type":"string","format":"date-time","description":"The timestamp when the AppSec rule was created."},"description":{"type":"string","description":"The rule description."},"shortDescription":{"type":"string","description":"A brief summary of the rule. If not provided, this field is null.","nullable":true},"detectionMethod":{"type":"string","description":"Security scanner used to detect findings for this rule."},"docLink":{"type":"string","description":"A URL linking to the relevant Cortex Cloud documentation page."},"domain":{"type":"string","description":"The domain associated with the rule."},"findingCategory":{"$ref":"#/components/schemas/FindingCategory"},"findingDocs":{"type":"string"},"findingTypeId":{"type":"number","format":"double","description":"The numeric identifier of the finding type associated with this rule. "},"findingTypeName":{"type":"string","description":"Display name of the finding type associated with this rule. Matches the rule `name` for custom rules."},"frameworks":{"type":"array","items":{"$ref":"#/components/schemas/Frameworks"}},"id":{"type":"string","description":"Unique identifier of the AppSec rule."},"isCustom":{"type":"boolean","description":"Indicates whether the rule is a custom rule created by the user (true) or an out-of-the-box rule (false)."},"isEnabled":{"type":"boolean","description":"Indicates whether the rule is currently active and will generate findings during scans."},"labels":{"type":"array","description":"Labels assigned to the rule.","items":{"type":"string"}},"updatedAt":{"type":"string","format":"date-time","description":"The timestamp when the AppSec rule was last modified."},"mitreTactics":{"type":"array","description":"The MITRE ATT&CK tactic identifiers associated with this rule. Returns an empty array if no tactics are mapped.","nullable":true,"items":{"type":"string"}},"mitreTechniques":{"type":"array","description":"The MITRE ATT&CK technique identifiers associated with this rule. Returns an empty array if no techniques are mapped.","nullable":true,"items":{"type":"string"}},"name":{"type":"string","description":"Name of the Appsec rule."},"owner":{"type":"string","description":"The internal service owner of the rule."},"scanner":{"$ref":"#/components/schemas/Scanner"},"severity":{"$ref":"#/components/schemas/Severity"},"subCategory":{"type":"string","description":"Custom rule subcategory."},"complianceStandards":{"$ref":"#/components/schemas/ComplianceStandard"},"cspmRuleId":{"type":"string","description":"The ID of the mapped Cloud Security rule. When set, findings from this AppSec rule are correlated with the corresponding Cloud Security rule. Returns `null` if no rule is mapped.","nullable":true},"cspmTypeId":{"type":"number","description":"The numeric type identifier of the mapped Cloud Security rule. Returned only when the AppSec rule is linked to a rule via `cspmRuleId`.","nullable":true}}},"CloudProvider":{"type":"string","enum":["ALIBABA_CLOUD","AWS","Azure","GCP","IBM","ORACLE","OTHER"],"description":"The cloud provider associated with the rule. If the rule is not cloud-provider-specific, this field is null."},"FindingCategory":{"type":"string","enum":["Code","Configuration","Data","Vulnerability"],"description":"Category of findings this rule generates."},"Frameworks":{"type":"object","properties":{"frameworkDetails":{"nullable":true,"allOf":[{"$ref":"#/components/schemas/FrameworkDetails"}]}},"description":"Framework objects containing the rule definition and remediation details for each supported IaC framework or secrets detection framework. "},"FrameworkDetails":{"type":"object","properties":{"definition":{"type":"string","description":"The rule definition.","nullable":true},"definition_link":{"type":"string","description":"**http** link to the definition documentation.","nullable":true},"name":{"$ref":"#/components/schemas/FrameworkName"},"remediation_description":{"type":"string","description":"The remediation steps that will appear on the Appsec rule's findings.","nullable":true},"remediation_ids":{"type":"array","description":"The IDs of related remediation resources.","nullable":true,"items":{"type":"string"}},"resource_types":{"type":"array","description":"The resource types associated with the rule.","nullable":true,"items":{"type":"string"}}}},"FrameworkName":{"type":"string","enum":["ARM","BICEP","CLOUDFORMATION","KUBERNETES","TERRAFORM"],"title":"FrameworkName","description":"Name of the configured Infrastructure as Code (IaC) framework for this rule definition. **Note:** Applicable only when `scanner` is set to `IAC`."},"Scanner":{"type":"string","enum":["CICD","IAC","SCA","SECRETS"],"description":"The scanner type used by this rule to detect security issues."},"Severity":{"type":"string","enum":["CRITICAL","HIGH","INFO","LOW","MEDIUM"],"title":"Severity","description":"Severity level of the rule"},"ComplianceStandard":{"type":"object","additionalProperties":false,"description":"An array of compliance standards associated with this rule.","properties":{"standardName":{"type":"string","description":"The name of the compliance framework or standard that this rule is mapped to. "},"controls":{"type":"array","items":{"$ref":"#/components/schemas/Control"}}}},"Control":{"type":"object","additionalProperties":false,"description":"An array of individual controls within the compliance standard that this rule satisfies. ","required":["controlName","controlDefinition"],"properties":{"controlName":{"type":"string","description":"The name or identifier of the compliance control."},"controlDefinition":{"type":"string","description":"A description of what the compliance control requires or validates. "}}}}}}
```

## Delete an AppSec rule

> Delete the specified Application Security rule.\
> \
> \*\*Required license:\*\* Cortex XDR with the Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security Add-on.

```json
{"openapi":"3.0.0","info":{"title":"ASPM, CICD and Application Security APIs","version":"Cortex XDR 5.2"},"tags":[{"name":"Rules","description":"APIs for managing rules"}],"servers":[{"url":"https://api-yourfqdn"}],"security":[],"paths":{"/public_api/appsec/v1/rules/{ruleId}":{"delete":{"tags":["Rules"],"summary":"Delete an AppSec rule","description":"Delete the specified Application Security rule.\n\n**Required license:** Cortex XDR with the Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security Add-on.","operationId":"DeleteRuleById","parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true},{"name":"ruleId","description":"Unique identifier of the Application Security rule","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Ok","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string"}},"required":["message"]}}}}}}}}}
```

## Update an AppSec rule

> Update an existing Application Security rule. If it's an out-of-the-box rule, the only modification you can make is to add labels. For custom rules, you can modify all of the fields.\
> \
> \*\*Note:\*\* To customize an out-of-the-box rule, you can create a custom rule by cloning the existing one. This allows you to make changes to the original rule according to your requirements.\
> \
> \*\*Required license:\*\* Cortex XDR with the Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security Add-on.

```json
{"openapi":"3.0.0","info":{"title":"ASPM, CICD and Application Security APIs","version":"Cortex XDR 5.2"},"tags":[{"name":"Rules","description":"APIs for managing rules"}],"servers":[{"url":"https://api-yourfqdn"}],"security":[],"paths":{"/public_api/appsec/v1/rules/{ruleId}":{"patch":{"tags":["Rules"],"summary":"Update an AppSec rule","description":"Update an existing Application Security rule. If it's an out-of-the-box rule, the only modification you can make is to add labels. For custom rules, you can modify all of the fields.\n\n**Note:** To customize an out-of-the-box rule, you can create a custom rule by cloning the existing one. This allows you to make changes to the original rule according to your requirements.\n\n**Required license:** Cortex XDR with the Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security Add-on.","operationId":"ModifyRule","parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true},{"name":"ruleId","description":"Unique identifier of the Application Security rule","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"anyOf":[{"$ref":"#/components/schemas/CreateOrModifyCustomRuleRequestParams"},{"$ref":"#/components/schemas/ModifyRuleParams"}]}}}},"responses":{"200":{"description":"Ok","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ModifyRuleResponseObject"}}}}}}}},"components":{"schemas":{"CreateOrModifyCustomRuleRequestParams":{"type":"object","title":"CreateOrModifyCustomRuleRequestParams","description":"Define the Application Security custom rule. The `category` option should match your selection for `scanner`.","additionalProperties":false,"required":["name","severity","scanner","frameworks","category","subCategory"],"properties":{"name":{"type":"string","description":"A unique name for the Appsec rule."},"description":{"type":"string","description":"Description of the rule"},"severity":{"$ref":"#/components/schemas/Severity"},"labels":{"type":"array","description":"Labels to be assigned to the rule","items":{"type":"string"}},"scanner":{"$ref":"#/components/schemas/CustomRuleScanner"},"frameworks":{"$ref":"#/components/schemas/FrameworkRequestParams"},"category":{"anyOf":[{"$ref":"#/components/schemas/CustomRuleIacCategory"},{"$ref":"#/components/schemas/CustomRuleSecretsCategory"}]},"subCategory":{"$ref":"#/components/schemas/CustomRuleIacSubCategory"},"cspmRuleId":{"type":"string","description":"The unique identifier of the Cloud Security rule to which the custom Application Security rule will be mapped. Applicable only when `scanner` is set to `IAC`.","nullable":true},"clonedFromRuleId":{"type":"string","description":"Optional. ID of the source rule from which this rule was cloned. This field is present only for cloned rules.","nullable":true}}},"Severity":{"type":"string","enum":["CRITICAL","HIGH","INFO","LOW","MEDIUM"],"title":"Severity","description":"Severity level of the rule"},"CustomRuleScanner":{"title":"CustomRuleScanner","description":"The type of security scanner used to detect findings of this rule. Choose any one of the scanners.","enum":["IAC","SECRETS"],"type":"string"},"FrameworkRequestParams":{"type":"object","title":"FrameworkRequestParams","additionalProperties":false,"required":["name","definition"],"properties":{"name":{"$ref":"#/components/schemas/FrameworkName"},"definition":{"type":"string","description":"The rule definition\n\nIaC example:\n`definition:\\n cond_type: attribute\\n resource_types:\\n - aws_s3_bucket_public_access_block\\n attribute: block_public_acls\\n operator: equals\\n value: false`\n\nSecrets example:\n`definition:\\n cond_type: secrets\\n value: AIza[0-9A-Za-z-_]{35}`\n","nullable":true},"definitionLink":{"type":"string","description":"**http** link to the definition documentation.","nullable":true},"remediationDescription":{"type":"string","description":"The remediation steps that will appear on the Appsec rule's findings.\n\nIaC Example: Set block_public_acls to true in aws_s3_bucket_public_access_block resource\n\nSecrets Example: Revoke the GCP API key immediately through the Google Cloud Console.","nullable":true}}},"FrameworkName":{"type":"string","enum":["ARM","BICEP","CLOUDFORMATION","KUBERNETES","TERRAFORM"],"title":"FrameworkName","description":"Name of the configured Infrastructure as Code (IaC) framework for this rule definition. **Note:** Applicable only when `scanner` is set to `IAC`."},"CustomRuleIacCategory":{"type":"string","enum":["AI_ML","COMPUTE","IAM","KUBERNETES","LOGGING","MONITORING","NETWORKING","PUBLIC","STORAGE"],"title":"CustomRuleIacCategory","description":"Custom rule IaC category. Applicable only when `scanner` is set to `IAC`."},"CustomRuleSecretsCategory":{"type":"string","enum":["API_KEYS","DATABASE_CREDENTIALS","ENCRYPTION_KEYS","CLOUD_SERVICE_PROVIDER_KEYS","SSH_KEYS","ENVIRONMENT_VARIABLES","SENSITIVE_TOKENS","THIRD_PARTY_SERVICES"],"title":"CustomRuleSecretsCategory","description":"Custom rule secret category. Applicable only when `scanner` is set to `SECRETS`."},"CustomRuleIacSubCategory":{"type":"string","enum":["GUARDRAILS","RISKY_MODELS","PUBLIC_EXPOSURE","PERMISSIONS","ENCRYPTION","RETENTION","FORMATS","DISABLED_OR_MISSING","UNDER_USE","NETWORK_POLICIES","ACCESS_CONTROL","LOGGING_AND_MONITORING","RESOURCE_MANAGEMENT","NATIVE_SECURITY_CONTROLS","MANAGEMENT_SERVICES_EXPOSURE","OVERPROVISIONED","STARTUP_SCRIPT_LEAKS","DEFAULT_CREDENTIALS_OR_AUTH","UNSANCTIONED_RESOURCE_OR_TYPE","BACKUPS","VERSIONING","REPLICATION","ALERTING","REDUNDANCY","ADMIN_INTERFACES","DATABASE_ENDPOINTS","STORAGE_BUCKETS","APIS","SENSITIVE_PORTS","LOAD_BALANCING","INGRESS_CONTROLS","EGRESS_CONTROLS","ENCRYPTION_AND_PROTOCOLS","VPC_VCN_VNET","FLOW_LOGS","TAGS_AND_METADATA","RESOURCE_HEALTH","PERFORMANCE_MONITORING","ALERTING_AND_NOTIFICATIONS","UNINTEGRATED","STORAGE","OVERLY_PERMISSIVE","UNUSED","CREDENTIAL_EXPOSURE","MFA","ROLE_SEPARATION","SHARED","EXPIRED_KEY_CONTROLS","AUTHENTICATION_POLICIES"],"title":"CustomRuleIacSubCategory","description":"Custom rule subcategory. The supported values depend on the selected category. Refer to the following table for the valid subcategories for each category.\n\nNote: This field is applicable only when `scanner` is set to `IAC`.\n\n## Category and Subcategory Table for IaC Scanner\n\n| Category | Subcategory |\n|----------|-------------|\n| AI and Machine Learning (`AI_ML`) | Guardrails (`GUARDRAILS`) |\n| AI and Machine Learning (`AI_ML`) | Risky models (`RISKY_MODELS`) |\n| AI and Machine Learning (`AI_ML`) | Public Exposure (`PUBLIC_EXPOSURE`) |\n| AI and Machine Learning (`AI_ML`) | Permissions (`PERMISSIONS`) |\n| Logging (`LOGGING`) | Encryption (`ENCRYPTION`) |\n| Logging (`LOGGING`) | Permissions (`PERMISSIONS`) |\n| Logging (`LOGGING`) | Retention (`RETENTION`) |\n| Logging (`LOGGING`) | Formats (`FORMATS`) |\n| Logging (`LOGGING`) | Disabled or missing (`DISABLED_OR_MISSING`) |\n| Logging (`LOGGING`) | Public Exposure (`PUBLIC_EXPOSURE`) |\n| Logging (`LOGGING`) | Under Use (`UNDER_USE`) |\n| Kubernetes (`KUBERNETES`) | Network Policies (`NETWORK_POLICIES`) |\n| Kubernetes (`KUBERNETES`) | Access Control (`ACCESS_CONTROL`) |\n| Kubernetes (`KUBERNETES`) | Logging and Monitoring (`LOGGING_AND_MONITORING`) |\n| Kubernetes (`KUBERNETES`) | Resource Management (`RESOURCE_MANAGEMENT`) |\n| Kubernetes (`KUBERNETES`) | Native Security Controls (`NATIVE_SECURITY_CONTROLS`) |\n| Kubernetes (`KUBERNETES`) | Management Services Exposure (`MANAGEMENT_SERVICES_EXPOSURE`) |\n| Compute (`COMPUTE`) | Overprovisioned (`OVERPROVISIONED`) |\n| Compute (`COMPUTE`) | Startup Script Leaks (`STARTUP_SCRIPT_LEAKS`) |\n| Compute (`COMPUTE`) | Default Credentials or Auth (`DEFAULT_CREDENTIALS_OR_AUTH`) |\n| Compute (`COMPUTE`) | Unsanctioned Resource or Type (`UNSANCTIONED_RESOURCE_OR_TYPE`) |\n| Storage (`STORAGE`) | Encryption (`ENCRYPTION`) |\n| Storage (`STORAGE`) | Permissions (`PERMISSIONS`) |\n| Storage (`STORAGE`) | Backups (`BACKUPS`) |\n| Storage (`STORAGE`) | Versioning (`VERSIONING`) |\n| Storage (`STORAGE`) | Replication (`REPLICATION`) |\n| Storage (`STORAGE`) | Alerting (`ALERTING`) |\n| Storage (`STORAGE`) | Redundancy (`REDUNDANCY`) |\n| Public (`PUBLIC`) | Admin Interfaces (`ADMIN_INTERFACES`) |\n| Public (`PUBLIC`) | Database Endpoints (`DATABASE_ENDPOINTS`) |\n| Public (`PUBLIC`) | Storage Buckets (`STORAGE_BUCKETS`) |\n| Public (`PUBLIC`) | APIs (`APIS`) |\n| Public (`PUBLIC`) | Sensitive Ports (`SENSITIVE_PORTS`) |\n| Networking (`NETWORKING`) | Load Balancing (`LOAD_BALANCING`) |\n| Networking (`NETWORKING`) | Ingress Controls (`INGRESS_CONTROLS`) |\n| Networking (`NETWORKING`) | Egress Controls (`EGRESS_CONTROLS`) |\n| Networking (`NETWORKING`) | Encryption and Protocols (`ENCRYPTION_AND_PROTOCOLS`) |\n| Networking (`NETWORKING`) | VPC/VCN/VNET (`VPC_VCN_VNET`) |\n| Networking (`NETWORKING`) | Flow Logs (`FLOW_LOGS`) |\n| Monitoring (`MONITORING`) | Tags and metadata (`TAGS_AND_METADATA`) |\n| Monitoring (`MONITORING`) | Resource Health (`RESOURCE_HEALTH`) |\n| Monitoring (`MONITORING`) | Performance Monitoring (`PERFORMANCE_MONITORING`) |\n| Monitoring (`MONITORING`) | Alerting and Notifications (`ALERTING_AND_NOTIFICATIONS`) |\n| Monitoring (`MONITORING`) | Unintegrated (`UNINTEGRATED`) |\n| Monitoring (`MONITORING`) | Storage (`STORAGE`) |\n| IAM (`IAM`) | Overly Permissive (`OVERLY_PERMISSIVE`) |\n| IAM (`IAM`) | Unused (`UNUSED`) |\n| IAM (`IAM`) | Credential Exposure (`CREDENTIAL_EXPOSURE`) |\n| IAM (`IAM`) | MFA (`MFA`) |\n| IAM (`IAM`) | Role Separation (`ROLE_SEPARATION`) |\n| IAM (`IAM`) | Shared (`SHARED`) |\n| IAM (`IAM`) | Expired Key Controls (`EXPIRED_KEY_CONTROLS`) |\n| IAM (`IAM`) | Authentication Policies (`AUTHENTICATION_POLICIES`) |"},"ModifyRuleParams":{"type":"object","title":"ModifyRuleParams","additionalProperties":false,"properties":{"labels":{"type":"array","description":"List of rule labels","items":{"type":"string"}}},"required":["labels"]},"ModifyRuleResponseObject":{"type":"object","title":"ModifyRuleResponseObject","description":"Updated details of the modified Application Security rule","properties":{"rule":{"$ref":"#/components/schemas/DetectionRule"}}},"DetectionRule":{"type":"object","title":"DetectionRule","description":"Details of the Application Security rule","properties":{"category":{"type":"string","description":"Custom Appsec rule category."},"cloudProvider":{"$ref":"#/components/schemas/CloudProvider"},"createdAt":{"type":"string","format":"date-time","description":"The timestamp when the AppSec rule was created."},"description":{"type":"string","description":"The rule description."},"shortDescription":{"type":"string","description":"A brief summary of the rule. If not provided, this field is null.","nullable":true},"detectionMethod":{"type":"string","description":"Security scanner used to detect findings for this rule."},"docLink":{"type":"string","description":"A URL linking to the relevant Cortex Cloud documentation page."},"domain":{"type":"string","description":"The domain associated with the rule."},"findingCategory":{"$ref":"#/components/schemas/FindingCategory"},"findingDocs":{"type":"string"},"findingTypeId":{"type":"number","format":"double","description":"The numeric identifier of the finding type associated with this rule. "},"findingTypeName":{"type":"string","description":"Display name of the finding type associated with this rule. Matches the rule `name` for custom rules."},"frameworks":{"type":"array","items":{"$ref":"#/components/schemas/Frameworks"}},"id":{"type":"string","description":"Unique identifier of the AppSec rule."},"isCustom":{"type":"boolean","description":"Indicates whether the rule is a custom rule created by the user (true) or an out-of-the-box rule (false)."},"isEnabled":{"type":"boolean","description":"Indicates whether the rule is currently active and will generate findings during scans."},"labels":{"type":"array","description":"Labels assigned to the rule.","items":{"type":"string"}},"updatedAt":{"type":"string","format":"date-time","description":"The timestamp when the AppSec rule was last modified."},"mitreTactics":{"type":"array","description":"The MITRE ATT&CK tactic identifiers associated with this rule. Returns an empty array if no tactics are mapped.","nullable":true,"items":{"type":"string"}},"mitreTechniques":{"type":"array","description":"The MITRE ATT&CK technique identifiers associated with this rule. Returns an empty array if no techniques are mapped.","nullable":true,"items":{"type":"string"}},"name":{"type":"string","description":"Name of the Appsec rule."},"owner":{"type":"string","description":"The internal service owner of the rule."},"scanner":{"$ref":"#/components/schemas/Scanner"},"severity":{"$ref":"#/components/schemas/Severity"},"subCategory":{"type":"string","description":"Custom rule subcategory."},"complianceStandards":{"$ref":"#/components/schemas/ComplianceStandard"},"cspmRuleId":{"type":"string","description":"The ID of the mapped Cloud Security rule. When set, findings from this AppSec rule are correlated with the corresponding Cloud Security rule. Returns `null` if no rule is mapped.","nullable":true},"cspmTypeId":{"type":"number","description":"The numeric type identifier of the mapped Cloud Security rule. Returned only when the AppSec rule is linked to a rule via `cspmRuleId`.","nullable":true}}},"CloudProvider":{"type":"string","enum":["ALIBABA_CLOUD","AWS","Azure","GCP","IBM","ORACLE","OTHER"],"description":"The cloud provider associated with the rule. If the rule is not cloud-provider-specific, this field is null."},"FindingCategory":{"type":"string","enum":["Code","Configuration","Data","Vulnerability"],"description":"Category of findings this rule generates."},"Frameworks":{"type":"object","properties":{"frameworkDetails":{"nullable":true,"allOf":[{"$ref":"#/components/schemas/FrameworkDetails"}]}},"description":"Framework objects containing the rule definition and remediation details for each supported IaC framework or secrets detection framework. "},"FrameworkDetails":{"type":"object","properties":{"definition":{"type":"string","description":"The rule definition.","nullable":true},"definition_link":{"type":"string","description":"**http** link to the definition documentation.","nullable":true},"name":{"$ref":"#/components/schemas/FrameworkName"},"remediation_description":{"type":"string","description":"The remediation steps that will appear on the Appsec rule's findings.","nullable":true},"remediation_ids":{"type":"array","description":"The IDs of related remediation resources.","nullable":true,"items":{"type":"string"}},"resource_types":{"type":"array","description":"The resource types associated with the rule.","nullable":true,"items":{"type":"string"}}}},"Scanner":{"type":"string","enum":["CICD","IAC","SCA","SECRETS"],"description":"The scanner type used by this rule to detect security issues."},"ComplianceStandard":{"type":"object","additionalProperties":false,"description":"An array of compliance standards associated with this rule.","properties":{"standardName":{"type":"string","description":"The name of the compliance framework or standard that this rule is mapped to. "},"controls":{"type":"array","items":{"$ref":"#/components/schemas/Control"}}}},"Control":{"type":"object","additionalProperties":false,"description":"An array of individual controls within the compliance standard that this rule satisfies. ","required":["controlName","controlDefinition"],"properties":{"controlName":{"type":"string","description":"The name or identifier of the compliance control."},"controlDefinition":{"type":"string","description":"A description of what the compliance control requires or validates. "}}}}}}
```

## Get AppSec rule labels

> Get a list of all of the Application Security rule labels.\
> \
> \*\*Required license:\*\* Cortex XDR with the Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security Add-on.

```json
{"openapi":"3.0.0","info":{"title":"ASPM, CICD and Application Security APIs","version":"Cortex XDR 5.2"},"tags":[{"name":"Rules","description":"APIs for managing rules"}],"servers":[{"url":"https://api-yourfqdn"}],"security":[],"paths":{"/public_api/appsec/v1/rules/rule-labels":{"get":{"summary":"Get AppSec rule labels","description":"Get a list of all of the Application Security rule labels.\n\n**Required license:** Cortex XDR with the Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security Add-on.","operationId":"GetLabels","parameters":[{"schema":{"type":"string"},"in":"header","name":"Authorization","description":"{api_key}","required":true},{"schema":{"type":"string"},"in":"header","name":"x-xdr-auth-id","description":"{api_key_id}","required":true}],"responses":{"200":{"description":"Ok","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GetLabelsResponse"}}}}},"tags":["Rules"]}}},"components":{"schemas":{"GetLabelsResponse":{"type":"object","title":"GetLabelsResponse","description":"A list of labels","additionalProperties":false,"properties":{"labels":{"type":"array","items":{"type":"string"}}}}}}}
```

## Create an AppSec rule validation

> \*\*Required license:\*\* Cortex XDR with the Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security Add-on.

```json
{"openapi":"3.0.0","info":{"title":"ASPM, CICD and Application Security APIs","version":"Cortex XDR 5.2"},"tags":[{"name":"Rules","description":"APIs for managing rules"}],"servers":[{"url":"https://api-yourfqdn"}],"security":[],"paths":{"/public_api/appsec/v1/rules/validate":{"post":{"operationId":"ValidateCustomRule","responses":{"200":{"description":"Ok","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ValidateCodeResponse"}}}}},"parameters":[],"requestBody":{"required":true,"content":{"application/json":{"schema":{"items":{"$ref":"#/components/schemas/ValidateCustomRuleRequestParams"},"type":"array"}}}},"summary":"Create an AppSec rule validation","tags":["Rules"],"description":"**Required license:** Cortex XDR with the Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security Add-on."}}},"components":{"schemas":{"ValidateCodeResponse":{"anyOf":[{"properties":{"frameworksErrors":{"type":"array","items":{"$ref":"#/components/schemas/FrameworkErrorsResponseData"}}}},{"properties":{"isValid":{"type":"boolean"}}}],"type":"object"},"FrameworkErrorsResponseData":{"type":"object","title":"FrameworkErrorsResponseData","additionalProperties":false,"properties":{"framework":{"$ref":"#/components/schemas/FrameworkName"},"errors":{"type":"array","items":{"type":"string"}}}},"FrameworkName":{"type":"string","enum":["ARM","BICEP","CLOUDFORMATION","KUBERNETES","TERRAFORM"],"title":"FrameworkName","description":"Name of the configured Infrastructure as Code (IaC) framework for this rule definition. **Note:** Applicable only when `scanner` is set to `IAC`."},"ValidateCustomRuleRequestParams":{"properties":{"framework":{"$ref":"#/components/schemas/FrameworkName"},"definition":{"type":"string"}},"required":["framework","definition"],"type":"object","additionalProperties":false}}}}
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/xdr-5-api/aspm-cicd-and-application-security/rules.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.