Policy condition fields

Overview

Custom policies use condition fields to match Cysmiq data. This reference is generated from the source policy field registry.

Cysmiq currently exposes 59 condition fields across 7 policy targets.

Finding-level policy conditions for vulnerabilities.

Field	Type	Operators	Values
`severity`	string	`=`, `!=`, `in`	`critical`, `high`, `medium`, `low`
`cvss_score`	number	`>`, `>=`, `<`, `<=`, `=`	-
`epss_score`	number	`>`, `>=`, `<`, `<=`, `=`	-
`cwe_ids`	array	`contains`, `overlaps`	workspace facts; custom values allowed
`impact_tags`	array	`contains`, `overlaps`	workspace facts; custom values allowed
`environment.key`	string	`=`, `!=`, `in`	workspace facts
`environment.is_production`	boolean	`=`, `!=`	-
`reference.ref`	string	`=`, `!=`, `prefix`, `in`	-
`reference.ref_type`	string	`=`, `!=`, `in`	`branch`, `tag`
`package_openssf.score`	number	`>`, `>=`, `<`, `<=`, `=`	-
`repository.tags`	array	`contains`, `overlaps`	workspace facts; custom values allowed
`application.tags`	array	`contains`, `overlaps`	workspace facts; custom values allowed

Package-level policy conditions.

Field	Type	Operators	Values
`openssf.score`	number	`>`, `>=`, `<`, `<=`, `=`	-
`repository.tags`	array	`contains`, `overlaps`	workspace facts; custom values allowed
`application.tags`	array	`contains`, `overlaps`	workspace facts; custom values allowed

Package version and dependency context conditions.

Field	Type	Operators	Values
`package.purl`	string	`=`, `!=`, `prefix`, `in`	workspace facts
`package.version_purl`	string	`=`, `!=`, `prefix`, `in`	workspace facts
`package.name`	string	`=`, `!=`, `in`	workspace facts
`package.namespace`	string	`=`, `!=`, `in`	workspace facts
`package.type`	string	`=`, `!=`, `in`	workspace facts
`package.version`	string	`=`, `!=`, `in`	workspace facts
`dependency.type`	string	`=`, `!=`, `in`	`direct`, `transitive`
`reference.ref`	string	`=`, `!=`, `prefix`, `in`	-
`reference.ref_type`	string	`=`, `!=`, `in`	`branch`, `tag`
`environment.key`	string	`=`, `!=`, `in`	workspace facts
`environment.is_production`	boolean	`=`, `!=`	-
`repository.tags`	array	`contains`, `overlaps`	workspace facts; custom values allowed
`application.tags`	array	`contains`, `overlaps`	workspace facts; custom values allowed

Manifest and dependency file conditions.

Field	Type	Operators	Values
`manifest_type`	string	`=`, `!=`, `in`	workspace facts
`environment.key`	string	`=`, `!=`, `in`	workspace facts
`environment.is_production`	boolean	`=`, `!=`	-
`reference.ref`	string	`=`, `!=`, `prefix`, `in`	-
`reference.ref_type`	string	`=`, `!=`, `in`	`branch`, `tag`
`repository.tags`	array	`contains`, `overlaps`	workspace facts; custom values allowed
`application.tags`	array	`contains`, `overlaps`	workspace facts; custom values allowed

Asset-level conditions.

Field	Type	Operators	Values
`type`	string	`=`, `!=`, `in`	workspace facts
`repository.tags`	array	`contains`, `overlaps`	workspace facts; custom values allowed
`application.tags`	array	`contains`, `overlaps`	workspace facts; custom values allowed

Secret finding conditions.

Field	Type	Operators	Values
`provider`	string	`=`, `!=`, `in`	workspace facts
`is_vulnerable`	boolean	`=`, `!=`	-
`is_exploitable`	boolean	`=`, `!=`	-
`is_verified`	boolean	`=`, `!=`	-
`manual_override`	boolean	`=`, `!=`	-
`environment.key`	string	`=`, `!=`, `in`	workspace facts
`environment.is_production`	boolean	`=`, `!=`	-
`reference.ref`	string	`=`, `!=`, `prefix`, `in`	-
`reference.ref_type`	string	`=`, `!=`, `in`	`branch`, `tag`
`repository.tags`	array	`contains`, `overlaps`	workspace facts; custom values allowed
`application.tags`	array	`contains`, `overlaps`	workspace facts; custom values allowed

Code finding conditions.

Field	Type	Operators	Values
`analysis_type`	string	`=`, `!=`, `in`	workspace facts
`is_vulnerable`	boolean	`=`, `!=`	-
`has_exploitable_call_hierarchy`	boolean	`=`, `!=`	-
`exploitable_call_hierarchy_count`	number	`>`, `>=`, `<`, `<=`, `=`	-
`environment.key`	string	`=`, `!=`, `in`	workspace facts
`environment.is_production`	boolean	`=`, `!=`	-
`reference.ref`	string	`=`, `!=`, `prefix`, `in`	-
`reference.ref_type`	string	`=`, `!=`, `in`	`branch`, `tag`
`repository.tags`	array	`contains`, `overlaps`	workspace facts; custom values allowed
`application.tags`	array	`contains`, `overlaps`	workspace facts; custom values allowed