Defining business applications by Criteria - The Criteria process uses tag-based criteria as the single source of truth to automatically define application assets and enable Code-to-Cloud risk correlation in real-time. - Administrator Guide - Cortex Cloud Posture Management - Cortex CLOUD

Automated application provisioning: Creating a single criteria definition generates multiple applications automatically, eliminating the need to create each application individually through the console

Dynamic asset grouping: Criteria continuously evaluate the asset inventory. As new repositories are onboarded or cloud resources are provisioned, matching assets are automatically added to the appropriate applications. Assets that no longer match are automatically removed

Consistent business context: Criteria enforce uniform business metadata (ownership, criticality) across all generated applications, preventing inconsistent manual configurations

Scalable application management: Organizations with hundreds of repositories or cloud accounts can manage application definitions through a small number of criteria rules rather than maintaining individual application configurations

Criteria types

Cortex Cloud supports two Criteria types, targeting different asset domains. Select the type that matches the source of organizational truth for your applications.

Code to cloud unification

You do not have to choose between code and cloud Criteria; both operate concurrently. When a Code rule groups a source repository and a Cloud rule groups the live infrastructure running that code, the platform automatically merges them into a single application boundary to provide true end-to-end risk correlation.

Continuous evaluation logic

The Criteria engine operates on a continuous evaluation model. It evaluates rules immediately upon saving and re-evaluates them on a periodic background cadence. As repositories are added, renamed, or removed, and as cloud resources gain or lose tags, the engine automatically updates application membership without manual intervention.

How business context prioritizes risk

When you define a Criteria rule, you assign business tags that every generated application automatically inherits. The platform uses these tags to prioritize issues:

Application access and policy scope

Criteria-generated applications define the scope for your security controls. The platform uses these application boundaries to enforce Unified Application Security Policies and to limit user permissions through Scope-Based Access Control (SBAC).