Custom policies

Overview

Custom policies evaluate condition logic against supported targets such as vulnerabilities, packages, package versions, manifests, assets, secrets, and code findings. Use custom policies when built-in SLA, package, or manifest policy types do not cover the control you want to express.

Targets

Supported target types are:

vulnerability
package
package_version
manifest
asset
secret
code

Each target type supports a different set of condition fields. See Policy condition fields for the source-backed reference. Environment condition fields come from environment mappings, which map repository branches and tags to deployment boundaries.

Condition structure

Conditions use nested groups:

Group	Meaning
`all`	Every child rule or group must match
`any`	At least one child rule or group must match
`not`	Negates one child rule or group

Rules use a field, operator, and value:

Condition rule

{ "field": "severity", "op": "in", "value": ["critical", "high"] }

Operators

Operators depend on the field type:

Field type	Common operators
String	`=`, `!=`, `in`, `prefix`
Number	`>`, `>=`, `<`, `<=`, `=`
Boolean	`=`, `!=`
Array	`contains`, `overlaps`

For in, contains, and overlaps, provide a JSON array value.

Actions

Custom policies can define actions:

Action	Purpose
SLA	Set a remediation window such as `7d` and whether to reset on regression
Notify	Notify selected users or roles when violations are created

SLA action

{
  "sla": {
    "window": "7d",
    "reset_on_regression": true
  }
}

Dry run

Dry run is available for custom policies with a target type. Use it to preview matches for a selected repository before relying on the policy in normal workflows. Dry runs can use the saved condition or a temporary condition override. For manifest and package-version targets, dry run uses current source evidence from the selected repository. Deleted references and removed dependency relationships are excluded.

JSON import

Custom policies can be imported from JSON. Imported policies are created disabled so they can be reviewed before activation.

Import shape

{
  "name": "Critical production vulnerabilities",
  "target_type": "vulnerability",
  "status": "disabled",
  "applies_by_default": true,
  "enforcement_mode": "block",
  "condition": {
    "all": [
      { "field": "severity", "op": "in", "value": ["critical", "high"] },
      { "field": "environment.is_production", "op": "=", "value": true }
    ]
  },
  "actions": {
    "sla": {
      "window": "7d",
      "reset_on_regression": true
    }
  }
}

Overview

Core concepts

Assets

Scanning

Integrations

Vulnerability management

Policies

Views & Filters

Insights

Security & access

Self-hosting

Reference

Custom policies

Overview

Targets

Condition structure

Operators

Actions

Dry run

JSON import

​Overview

​Targets

​Condition structure

​Operators

​Actions

​Dry run

​JSON import

​Related docs

Overview

Targets

Condition structure

Operators

Actions

Dry run

JSON import

Related docs