Skip to main content
Policies turn security data into consistent rules for monitoring and enforcement. When a policy matches a target, Cysmiq creates a policy violation for review and follow-up.

​
Prerequisites

  • A workspace with scanned security data
  • Workspace owner permission to create and manage policies
Availability depends on your Cysmiq plan.

​
Steps

1

Start a custom policy

Open Settings, select Policies, then select New policy. In Basics:
  • Enter a name that describes the rule’s intent.
  • Choose the target type, such as Vulnerability, Package, or Manifest.
  • Keep the policy Active when it should evaluate current data.
  • Choose whether it applies everywhere by default or only where it is explicitly bound.
  • Select Monitor, Warn, or Block for its enforcement behavior.
This example blocks critical and high-severity vulnerability matches.
2

Build the match criteria

In Match, select fields, operators, and values. Use nested groups when the policy needs several conditions:
  • All requires every item in the group to match.
  • Any requires at least one item to match.
  • None requires every item in the group to remain unmatched.
Policy creation wizard showing an All group where vulnerability severity is in critical or high.

A custom vulnerability policy matching critical and high severities.

Use the Policy condition fields reference for supported fields, operators, and values.
3

Configure the response

In Response, optionally set an SLA window and notification recipients. The enforcement mode controls how matched violations affect connected workflows:
  • Monitor records violations without warning or blocking.
  • Warn surfaces warning-level enforcement.
  • Block surfaces blocking enforcement.
Review the summary, then create the policy.
4

Preview matches

Open the policy and select Dry run. Choose a repository and run the preview to see current matches using the unsaved match criteria. A dry run does not create policy violations.
Policy dry-run results showing one blocking Flask debug vulnerability match.

A dry run finding one blocking match in the storefront repository.

Review the matched target, scope, enforcement, and context before saving policy changes.
5

Review policy violations

Open Policy Violations to review active matches across the workspace. The table shows the policy, status, scope, target, timing, and assignee.
Policy Violations page showing an open blocking violation for the Flask debug vulnerability.

A blocking policy violation created from the high-severity rule.

Open a violation to assign an owner, review its scope and target, request or apply a snooze when available, and record the final decision. See Policy violations for the complete lifecycle.