Create a Cloud Workload Policy - Administrator Guide - Cortex CLOUD

Cortex Cloud Posture Management Documentation
Product
Cortex Cloud Application Security > Cortex CLOUD
License
Cloud Posture Management
Creation date
2025-01-22
Last date published
2026-06-10
Category
Administrator Guide

You can create policies to address specific types of security risks or compliance requirements.

To create a cloud workload policy:

Navigate to Posture Management → Rules & Policies → Policies → Cloud Workload. 

In the Cloud Workload Policy page, click Create Policy and select the type of policy you want to create:

  1. Enter a unique name and description. Note that these are mandatory fields.

  2. The Evaluation Stage will be selected as Runtime.

    Note

    The Evaluation stage for Misconfiguration policies is supported only in the Runtime SDLC stage and is enforceable through the Kubernetes Admission Controller for clusters on-boarded using the Posture Management (KSPM) Connector.

  3. Click Next

  4. The Summary section on the right displays a real-time, interactive view of all policy configurations as users progress through the wizard. It automatically updates to reflect the current selections and settings, enabling seamless navigation between fields from any step in the wizard. It includes the following sections:

    • General – Policy name and description.

    • Rules – No. of selected rules and the asset types relevant to the selected rules.

    • Scope - The defined scopes included in the policy and SDLC stage.

  5. In the Rules section:

    • Click on Add Rules to select the rules that identify the violations that you want to track.

      A new window opens, displaying a list of all the existing predefined OOTB rules. See Rules filters for details on applying filters to refine the list of rules.

      Note

      Use Create a new Custom Detection Rule to define and add new custom rules as required.

    • After completing your selection, click Select to confirm. The chosen rules are displayed in the Rules section, where you can toggle between the Cards and Grid view to display the rules in your preferred layout.

    • In the Rules section, you can select one or more rules to modify the Severity, Policy Action and Remediation values, either individually or in bulk.

      Note

      Each rule may support different actions. While some include both Create an Issue and Prevent and Create an Issue, others provide only the Create an Issue option.

  6. In the Scope section, for the Scope Selection Method , select Asset Groups or Default Asset Scopes, depending on your preference.

    1. If you select Asset Groups, you can choose between the following options:

    2. On selecting Default Asset Scopes, you can further select the Assets Scope from the predefined Asset Scopes that are filtered based on the selected rules in the previous section and their applicable Asset Types. The Scope options are dynamically updated and limited to the applicable asset types of the selected rules, ensuring that users can select only valid and compatible scopes.

  7. Click Done to complete the process and create the new Misconfiguration Workload Policy.

  1. Enter a unique name and description. Note that these are mandatory fields.

  2. Select an SDLC Evaluation Stage. The following options are available.

    • CI

    • Runtime

    • Deploy

  3. Click Next.

  4. The Summary section on the right provides a real-time, readable view of all policy configurations as users progress through the wizard. It automatically updates to reflect current selections and settings. It includes the following sections:

    • General – Policy name and description.

    • Conditions – Selected rule filter and exclusion criteria.

    • Scope - The defined scopes included in the policy and SDLC stage.

    • Actions - Selected action type.

  5. Configure the settings specific to the evaluation stage you select.

  • Enter a unique name and description. Note that these are mandatory fields.

  • Select an SDLC Evaluation Stage. The following options are available.

    • CI

    • Runtime

    • Deploy

  • Click Next.

  • The Summary section on the right provides a real-time, readable view of all policy configurations as users progress through the wizard. It automatically updates to reflect current selections and settings. It includes the following sections:

    • General – Policy name and description.

    • Conditions – Selected rule filter and exclusion criteria.

    • Scope - The defined scopes included in the policy and SDLC stage.

    • Actions - Selected action type.

  • Configure the settings specific to the evaluation stage you select.

  1. Enter a unique name and description. Note that these are mandatory fields. The SDLC Evaluation Stage is preset to Runtime.

  2. Click Next.

  3. Configure the policy's condition settings.

    1. In the Conditions section, specify the criteria to identify relevant images.

      You can specify criteria to define both broad policies and strict policies, for example: Trust images (from registryX or registryY) OR (digestA or digestB). An example of criteria for a broad policy could be all images from gcr.io/myorg/ while an example of criteria for a strict policy could be: gcr.io/myorg/app@sha256:abc123.

      You can also include exclusion criteria to filter out any images that meet specific conditions for exclusion from this policy.

      Because trust is subjective, context-dependent, and scope-based, we recommend you create finely-tuned criteria. For example, an image might be trusted in a low-risk demo environment because it has relaxed patching requirements, but it would be instantly blocked as untrusted in a production environment. For more information, see Trusted Image Policies.

    2. Click Next.

  4. Configure the policy's scope settings.

    1. In the Scope section, for the Scope Selection Method select Asset Groups or Default Asset Scopes.

      • Asset Groups. The policy applies only to Cloud workload container images, container instances, hosts (VM instances), serverless functions or Kubernetes workload asset types in those groups that are available at the Runtime SDLC stage. A list of available asset groups is displayed. You can then select the asset group to which you want this policy to apply.

        We recommend narrowing the asset group scope to ensure that a policy only checks relevant assets. For more information, see Trusted Images Policies.

        Consider the following when specifying criteria for the policy's scope:

        • Exclude system-critical Kubernetes namespaces, such as kube-system, from the policy scope to avoid interfering with core cluster operations.

        • If you select an asset group that contains a specific namespace, the policy will apply only to resources in that namespace—not the entire cluster.

      • Default Asset Scopes. On selecting Default Asset Scopes , you can further select the Asset Types:

        • All Cloud Workload Assets

        • All Cloud Workload Container Images

        • All Cloud Workload Kubernetes Workloads

        • All Cloud Workload Serverless Functions

        • All Cloud Workload Hosts (VM Instances)

    2. Click Next.

  5. Configure the policy's action settings. In the Action section:

    1. For Select an Action, choose either Create an issue to log an issue if the policy is violated or Prevent and create an issue to prevent and create an issue. For more information, see Preventative action.

    2. If you select Prevent and create an issue as the policy's action, an additional Action when trust verdict is unavailable option becomes available. This is for situations where there is insufficient information available for determining if the image is trusted. The default is Prevent and create an issue.

    3. Under Issue Severity, choose Critical, High, Medium, or Low to define the issue severity.

    4. In the Remediation Guidance field, enter optional remediation instructions.

    Issues are automatically closed when the affected asset is removed from the inventory or when the policy is deleted. You can manually close issues at any time.

  6. Click Done to complete the process and create the new policy.