Supported Scope Fields

This table defines the available fields for building policy scopes that target specific assets.

Pretty Name (FIELD_PRETTY_NAME)	Field Name (SEARCH_FIELD)	Data Type (DATA_TYPE)	Allowed (SEARCH_TYPE) Values	Possible search values (SEARCH_VALUE)	Description	Relevant Finding Types
Application Business Criticality	application_business_criticality	ENUM	EQ, NEQ	CRITICAL, HIGH, MEDIUM, LOW	The criticality level of the application.	All
Application Business Owner	application_business_owner	STRING	CONTAINS_IN_LIST, NOT_CONTAINS_IN_LIST	(No predefined list)	The owner's identifier for the business application.	All
Asset Type	asset_type_name	ENUM	EQ, NEQ	BUILD_IMAGE, BUSINESS_APPLICATION, BUSINESS_APPLICATION, CIRCLE_CI_REPOSITORY, ORTEX_CLI_REPOSITORY, GITHUB_ACTIONS_REPOSITORY, GITHUB_ENTERPRISE_REPOSITORY, GITHUB_REPOSITORY, GITLAB_REPOSITORY, GITLAB_SELF_MANAGED_REPOSITORY, GOOGLE_CLOUD_REPOSITORY, HCP_TFC_RUN_TASKS_REPOSITORY, HCP_TFE_RUN_TASKS_REPOSITORY, JENKINS_REPOSITORY, REGISTRY_IMAGE	The type of asset being evaluated, such as a repository, build image, or registry image.	IAC_MISCONFIGURATION, SECRETS, VULNERABILITY, LICENSES, OPERATIONAL_RISK, CODE_WEAKNESS, MALWARE
Asset Type	asset_type_name	STRING	WILDCARD, WILDCARD_NOT, CONTAINS, NCONTAINS	(No predefined list)	The type of asset being evaluated, specified as a free-text string.	CICD_RISKS
Business Application Names	business_application_names	STRING	ARRAY_CONTAINS, ARRAY_NOT_CONTAINS, NIS_EMPTY	(No predefined list)	Filter by the names of the business applications.	All
Category	category	ENUM	EQ, NEQ	APPLICATION, CONTAINER_IMAGE, REPOSITORY, CICD_INSTANCE, CICD_PIPELINE, VCS_COLLABORATOR, VCS_ORGANIZATION	The asset type categories to include.	All
CI/CD Instance Id	cicd_instance_id	STRING	WILDCARD, WILDCARD_NOT, CONTAINS, NCONTAINS	(No predefined list)	The unique identifier of the CI/CD instance	CICD_RISKS
CI/CD Instance Name	cicd_instance_name	STRING	WILDCARD, WILDCARD_NOT, CONTAINS, NCONTAINS	(No predefined list)	The name of the CI/CD instance.	CICD_RISKS
CI/CD Pipeline Id	cicd_pipeline_id	STRING	WILDCARD, WILDCARD_NOT, CONTAINS, NCONTAINS	(No predefined list)	The unique identifier of the CI/CD pipeline	CICD_RISKS
CI/CD Pipeline Name	cicd_pipeline_name	STRING	WILDCARD, WILDCARD_NOT, CONTAINS, NCONTAINS	(No predefined list)	The name of the CI/CD pipeline	CICD_RISKS
Cloud Account	cloud_account	STRING	EQ, NEQ, CONTAINS	(No predefined list)	Filter by the cloud account names	DRIFT
Cloud Region	cloud_region	STRING	EQ, NEQ, CONTAINS	(No predefined list)	Filter by the cloud region	DRIFT
Has Deployed Assets	has_deployed_assets	BOOLEAN	EQ, NEQ	true, false	Whether the repository has any deployed components.	IAC_MISCONFIGURATION, SECRETS, VULNERABILITY, LICENSES, OPERATIONAL_RISK, CODE_WEAKNESS, MALWARE, DRIFT
Has deployed assets with Access to sensitive data	has_access_sensitive_data	BOOLEAN	EQ, NEQ	true, false	Whether deployed assets have access to sensitive data stores.	IAC_MISCONFIGURATION, SECRETS, VULNERABILITY, LICENSES, OPERATIONAL_RISK, CODE_WEAKNESS, MALWARE, DRIFT
Has deployed assets with privileged capabilities	has_leverage_privileged_capabilities	BOOLEAN	EQ, NEQ	true, false	Whether deployed assets have privileged execution capabilities.	IAC_MISCONFIGURATION, SECRETS, VULNERABILITY, LICENSES, OPERATIONAL_RISK, CODE_WEAKNESS, MALWARE, DRIFT
Has Internet-exposed deployed assets	has_internet_exposed	BOOLEAN	EQ, NEQ	true, false	Whether the deployed components are exposed to the internet.	IAC_MISCONFIGURATION, SECRETS, VULNERABILITY, LICENSES, OPERATIONAL_RISK, CODE_WEAKNESS, MALWARE, DRIFT
Image Architecture	image_architecture	STRING	WILDCARD, WILDCARD_NOT, CONTAINS, NCONTAINS	(No predefined list)	The CPU architecture of the container image	IAC_MISCONFIGURATION, SECRETS, VULNERABILITY, LICENSES, OPERATIONAL_RISK, CODE_WEAKNESS, MALWARE
Image Names	image_names	STRING	CONTAINS_IN_LIST, NOT_CONTAINS_IN_LIST	(No predefined list)	Filter by the names of Registry images	IAC_MISCONFIGURATION, SECRETS, VULNERABILITY, LICENSES, OPERATIONAL_RISK, CODE_WEAKNESS, MALWARE
Is Public Repository	is_public_repository	BOOLEAN	EQ, NEQ	true, false	Whether the repository is public.	All
Organization URL	organization_url	STRING	CONTAINS_IN_LIST, NOT_CONTAINS_IN_LIST	(No predefined list)	The URL of the version control system (VCS) organization or group	IAC_MISCONFIGURATION, SECRETS, VULNERABILITY, LICENSES, OPERATIONAL_RISK, CODE_WEAKNESS, MALWARE
Provider	repository_provider	ENUM	EQ, NEQ	ACTIVE_DIRECTORY AKAMAI ALIBABA_CLOUD ATT AWS AWS_CLOUD AWS_CODE_BUILD AWS_CODE_COMMIT AZURE AZURE_CLOUD AZURE_DEVOPS AZURE_PIPELINES AZURE_REPOS BITBUCKET BITBUCKET_DATACENTER CHARTER_COMMUNICATIONS CHECKMARX CIRCLE_CI CLOUDFLARE CORTEX_CLI DATABRICKS DOCKER DOCKER_HUB FASTLY GCP GCP_CLOUD GITHUB GITHUB_ACTIONS GITHUB_ENTERPRISE GITLAB GITLAB_CI GITLAB_CONTAINER_REGISTRY GITLAB_SELF_MANAGED HARBOR HCP_TFC_RUN_TASKS HCP_TFE_RUN_TASKS IBM_CLOUD INCAPSULA JENKINS JFROG_ARTIFACTORY MICROSOFT_OFFICE_365 OCI OCI_CLOUD OKTA ON_PREM ORACLE OTHER PANW RACKSPACE SEMGREP SNOWFLAKE SNYK SONARQUBE SONATYPE VERACODE	The infrastructure or code hosting provider.	All
Repository Id	repository_id	STRING	WILDCARD, WILDCARD_NOT, CONTAINS, NCONTAINS	(No predefined list)	The unique ID of the repository.	All
Repository labels	repository_labels	ENUM	ARRAY_CONTAINS, ARRAY_NOT_CONTAINS	ARCHIVED, PRIVATE, PUBLIC	Whether the repository labels are public, private, or archieved. - Need to get this description reviewed	IAC_MISCONFIGURATION, SECRETS, VULNERABILITY, LICENSES, OPERATIONAL_RISK, CODE_WEAKNESS, MALWARE
Repository Name	repository_name	STRING	WILDCARD, WILDCARD_NOT, CONTAINS, NCONTAINS	(No predefined list)	The name of the code repository.	All
Source Branch	source_branch	STRING	WILDCARD, WILDCARD_NOT, CONTAINS, NCONTAINS	(No predefined list)	Name of the source branch in the repository.	IAC_MISCONFIGURATION, SECRETS, VULNERABILITY, LICENSES, OPERATIONAL_RISK, CODE_WEAKNESS, MALWARE
Tags	asset_tags	STRING	WILDCARD, NOT_WILDCARD	(No predefined list)	Custom tags assigned to the asset	IAC_MISCONFIGURATION, SECRETS, VULNERABILITY, LICENSES, OPERATIONAL_RISK, CODE_WEAKNESS, MALWARE, CICD_RISKS
VCS Collaborator Email	collaborator_email	STRING	WILDCARD, WILDCARD_NOT, CONTAINS, NCONTAINS	(No predefined list)	The email address of the VCS collaborator.	CICD_RISKS
VCS Collaborator Last Observed	collaborator_inactive_days	STRING	EQ, NEQ, LTE, GTE	(No predefined list)	The number of days since the VCS collaborator was last active.	CICD_RISKS
VCS Collaborator MFA Enabled	collaborator_mfa_enabled	BOOLEAN	EQ, NEQ	TRUE, FALSE	Whether the VCS collaborator has multi-factor authentication (MFA) enabled on their account.	CICD_RISKS
VCS Collaborator Name	collaborator_name	STRING	WILDCARD, WILDCARD_NOT, CONTAINS, NCONTAINS	(No predefined list)	Name of the VCS collaborator.	CICD_RISKS
VCS Organization Name	repository_organization_name	STRING	WILDCARD, WILDCARD_NOT, CONTAINS, NCONTAINS	(No predefined list)	The name of the VCS organization that owns the repository.	CICD_RISKS

SEARCH_FIELDstringrequired

Defines the field the matching criteria filter should match. To see which fields are allowed for each type, see the Supported Scope Fields table.

SEARCH_TYPEstring (Enum)required

Condition operator for this filter.

Allowed values:"ARRAY_CONTAINS""ARRAY_NOT_CONTAINS""CONTAINS""CONTAINS_IN_LIST""EQ""GT""GTE""IN""JSON_WILDCARD""JSON_WILDCARD_NOT""LTE""LT""NCONTAINS""NEQ""NIN""NOT_CONTAINS_IN_LIST""RANGE""RELATIVE_TIMESTAMP""WILDCARD""WILDCARD_NOT""withinGracePeriod"

SEARCH_VALUEobjectrequired

Value that the condition filter must match. The type of this field will differ depending on the SEARCH_FIELD that you specified.

Any of

boolean

Value that the condition filter must match. The type of this field will differ depending on the SEARCH_FIELD that you specified.

numberdouble

Value that the condition filter must match. The type of this field will differ depending on the SEARCH_FIELD that you specified.

string

Value that the condition filter must match. The type of this field will differ depending on the SEARCH_FIELD that you specified.

ANDarray

[

SEARCH_FIELDstringrequired

Field the condition filter matches.

Example:"Finding Type"

SEARCH_TYPEstring (Enum)required

Condition operator for this filter.

SEARCH_VALUEobjectrequired

The value compared against. The type of this field will differ depending on the SEARCH_FIELD that was specified.

Any of

boolean

The value compared against. The type of this field will differ depending on the SEARCH_FIELD that was specified.

fromnumberdouble

The lower bound of a range query.

tonumberdouble

The upper bound of a range query.

keystring

The key for key-value pair matching.

valuestring

The value for key-value pair matching.

numberdouble

The value compared against. The type of this field will differ depending on the SEARCH_FIELD that was specified.

string

The value compared against. The type of this field will differ depending on the SEARCH_FIELD that was specified.

ANDarray

[

SEARCH_FIELDstringrequired

Field the condition filter matches.

Example:"Finding Type"

SEARCH_TYPEstring (Enum)required

Condition operator for this filter.

SEARCH_VALUEobjectrequired

The value compared against. The type of this field will differ depending on the SEARCH_FIELD that was specified.

Any of

boolean

The value compared against. The type of this field will differ depending on the SEARCH_FIELD that was specified.

fromnumberdouble

The lower bound of a range query.

tonumberdouble

The upper bound of a range query.

keystring

The key for key-value pair matching.

valuestring

The value for key-value pair matching.

numberdouble

The value compared against. The type of this field will differ depending on the SEARCH_FIELD that was specified.

string

The value compared against. The type of this field will differ depending on the SEARCH_FIELD that was specified.

ANDarray

Recursive model

ORarray

Recursive model

]

ORarray

[

SEARCH_FIELDstringrequired

Field the condition filter matches.

Example:"Finding Type"

SEARCH_TYPEstring (Enum)required

Condition operator for this filter.

SEARCH_VALUEobjectrequired

The value compared against. The type of this field will differ depending on the SEARCH_FIELD that was specified.

Any of

boolean

The value compared against. The type of this field will differ depending on the SEARCH_FIELD that was specified.

fromnumberdouble

The lower bound of a range query.

tonumberdouble

The upper bound of a range query.

keystring

The key for key-value pair matching.

valuestring

The value for key-value pair matching.

numberdouble

The value compared against. The type of this field will differ depending on the SEARCH_FIELD that was specified.

string

The value compared against. The type of this field will differ depending on the SEARCH_FIELD that was specified.

ANDarray

Recursive model

ORarray

Recursive model

]

ORarray

[

SEARCH_FIELDstringrequired

Field the condition filter matches.

Example:"Finding Type"

SEARCH_TYPEstring (Enum)required

Condition operator for this filter.

SEARCH_VALUEobjectrequired

The value compared against. The type of this field will differ depending on the SEARCH_FIELD that was specified.

Any of

boolean

The value compared against. The type of this field will differ depending on the SEARCH_FIELD that was specified.

fromnumberdouble

The lower bound of a range query.

tonumberdouble

The upper bound of a range query.

keystring

The key for key-value pair matching.

valuestring

The value for key-value pair matching.

numberdouble

The value compared against. The type of this field will differ depending on the SEARCH_FIELD that was specified.

string

The value compared against. The type of this field will differ depending on the SEARCH_FIELD that was specified.

ANDarray

[

SEARCH_FIELDstringrequired

Field the condition filter matches.

Example:"Finding Type"

SEARCH_TYPEstring (Enum)required

Condition operator for this filter.

SEARCH_VALUEobjectrequired

The value compared against. The type of this field will differ depending on the SEARCH_FIELD that was specified.

Any of

boolean

The value compared against. The type of this field will differ depending on the SEARCH_FIELD that was specified.

fromnumberdouble

The lower bound of a range query.

tonumberdouble

The upper bound of a range query.

keystring

The key for key-value pair matching.

valuestring

The value for key-value pair matching.

numberdouble

The value compared against. The type of this field will differ depending on the SEARCH_FIELD that was specified.

string

The value compared against. The type of this field will differ depending on the SEARCH_FIELD that was specified.

ANDarray

Recursive model

ORarray

Recursive model

]

ORarray

[

SEARCH_FIELDstringrequired

Field the condition filter matches.

Example:"Finding Type"

SEARCH_TYPEstring (Enum)required

Condition operator for this filter.

SEARCH_VALUEobjectrequired

The value compared against. The type of this field will differ depending on the SEARCH_FIELD that was specified.

Any of

boolean

The value compared against. The type of this field will differ depending on the SEARCH_FIELD that was specified.

fromnumberdouble

The lower bound of a range query.

tonumberdouble

The upper bound of a range query.

keystring

The key for key-value pair matching.

valuestring

The value for key-value pair matching.

numberdouble

The value compared against. The type of this field will differ depending on the SEARCH_FIELD that was specified.

string

The value compared against. The type of this field will differ depending on the SEARCH_FIELD that was specified.

ANDarray

Recursive model

ORarray

Recursive model

]

triggersobject

Defines when the AppSec policy should be evaluated. Configure triggers for periodic code scans, Pull Requests (PRs), CI Code scan, CI image scans, and Registry image scans. At least one trigger must have isEnabled set to true.

cicdobject

Configuration for the CI Code trigger. If true, the policy is evaluated on CI/CD pipeline events.

actionsobject

Actions to take when the policy detects its target risk and the policy is triggered.

blockCicdbooleanrequired

Indicates if triggering the policy should block the CI/CD pipeline.

reportCicdbooleanrequired

Indicates if triggering the policy should soft fail the CI/CD pipeline in the platform.

reportIssuebooleanrequired

Indicates if triggering the policy should create an issue.

isEnabledbooleanrequired

Indicates whether the CI Code Scan trigger is enabled.

Default:true

overrideIssueSeverityobject (Enum)

Optional. Set the severity of the issue (and override the system severity). If not used or set to null, system severity is kept.

Allowed values:"Critical""High""Medium""Low"

ciImageobject

Configuration for the CI image trigger. If true, the policy is evaluated during CI image scans.

actionsobject

Actions to take when the policy detects its target risk and the policy is triggered.

blockCicdbooleanrequired

Indicates if triggering the policy should block the CI image.

reportCicdbooleanrequired

Indicates if triggering the policy should soft fail the CI image in the platform.

reportIssuebooleanrequired

Indicates if triggering the policy should create an issue.

isEnabledbooleanrequired

Indicates whether the CI Image Scan trigger is enabled.

Default:true

overrideIssueSeverityobject (Enum)required

Set the severity of the issue (and override the system severity). If not used or set to null, system severity is kept.

Allowed values:"Critical""High""Medium""Low"

imageRegistryobject

Configuration for the image registry trigger. If true, the policy is evaluated during registry image scans.

actionsobject

Actions to take when the policy detects its target risk and the policy is triggered.

reportIssuebooleanrequired

Indicates if triggering the policy should create an issue.

isEnabledbooleanrequired

Indicates whether the Registry Image Scan trigger is enabled.

overrideIssueSeverityobject (Enum)required

Set the severity of the issue (and override the system severity). If not used or set to null, system severity is kept.

Allowed values:"Critical""High""Medium""Low"

periodicobject

Configuration for the periodic code scan (scheduled) trigger. If true, the policy is evaluated.

actionsobject

Actions to take when the policy detects its target risk and the policy is triggered.

reportIssuebooleanrequired

Indicates if triggering the policy should create an issue.

isEnabledbooleanrequired

Indicates whether the Periodic Scan trigger is enabled.

Default:true

overrideIssueSeverityobject (Enum)

Optional. Set the severity of the issue (and override the system severity). If not used or set to null, system severity is kept.

Allowed values:"Critical""High""Medium""Low"

probject

Configuration for the pull request (PR) trigger. If true, the policy is evaluated on Pull Request (PR) events

actionsobject

Actions to take when the policy detects its target risk and the policy is triggered.

blockPrbooleanrequired

Indicates if triggering the policy should block the pull request.

reportIssuebooleanrequired

Indicates if triggering the policy should create an issue.

reportPrCommentbooleanrequired

Indicates if triggering the policy should create comments on the pull request.

isEnabledbooleanrequired

Indicates whether the PR Scan trigger is enabled.

Default:true

overrideIssueSeverityobject (Enum)

Optional. Set the severity of the issue (and override the system severity). If not used or set to null, system severity is kept.

Allowed values:"Critical""High""Medium""Low"

relatedDetectionRulesarray[string]

List of related detection rules.

enabledboolean

Whether the policy is enabled.

suggestionIdstring

Unique identifier for the suggested policy.

assetGroupIdsarray[number]

List of asset groups to which the policy applies. If the array is empty, the policy applies to all asset groups.

userSbacarray[number]

Asset group IDs representing the user's scoped-based access control (SBAC) permissions at the time the policy is modified. Controls which asset groups the policy applies to based on the modifier's access. When empty, the policy applies to all asset groups.

REQUESTExample 1
{
  "name": "Updated policy name",
  "description": "Updated policy description",
  "conditions": {
    "AND": [
      {
        "SEARCH_FIELD": "Finding Type",
        "SEARCH_TYPE": "EQ",
        "SEARCH_VALUE": "VULNERABILITY"
      },
      {
        "OR": [
          {
            "SEARCH_FIELD": "Severity",
            "SEARCH_TYPE": "EQ",
            "SEARCH_VALUE": "CRITICAL"
          },
          {
            "SEARCH_FIELD": "Severity",
            "SEARCH_TYPE": "EQ",
            "SEARCH_VALUE": "HIGH"
          }
        ]
      }
    ]
  },
  "scope": {
    "AND": [
      {
        "SEARCH_FIELD": "has_deployed_assets",
        "SEARCH_TYPE": "EQ",
        "SEARCH_VALUE": true
      }
    ]
  },
  "triggers": {
    "periodic": {
      "isEnabled": true,
      "actions": {
        "reportIssue": true
      },
      "overrideIssueSeverity": "High"
    },
    "pr": {
      "isEnabled": true,
      "actions": {
        "reportIssue": true,
        "blockPr": true,
        "reportPrComment": true
      },
      "overrideIssueSeverity": null
    },
    "cicd": {
      "isEnabled": true,
      "actions": {
        "reportIssue": true,
        "blockCicd": false,
        "reportCicd": true
      },
      "overrideIssueSeverity": null
    },
    "ciImage": {
      "isEnabled": false,
      "actions": {
        "reportIssue": false,
        "blockCicd": false,
        "reportCicd": false
      },
      "overrideIssueSeverity": null
    },
    "imageRegistry": {
      "isEnabled": false,
      "actions": {
        "reportIssue": false
      },
      "overrideIssueSeverity": null
    }
  }
}

Responses

No content

Unprocessable Entity

Body

application/json

errorCodestring

The HTTP error category. Indicates the general type of error that occurred.

messagestring

A human-readable message with specific details about why the request failed. Use this message for debugging and troubleshooting.

RESPONSE

{
  "errorCode": "_BadParamsError",
  "message": "The following triggers are not compatible with the policy conditions: [CI Image, Image Registry]. Allowed triggers based on conditions: [PR, CI/CD, Periodic]."
}

{
  "errorCode": "_BadParamsError",
  "message": "Conditions cannot be empty."
}