Policies

A policy is a configurable rule for automating DevSecOps processes that uses an event-driven model. It lets the system respond to internal events or run on a schedule while performing specified actions on system entities.

A policy consists of three sequential components:

1. Trigger—an event that activates the policy. This event can be a change to an entity, such as creating a project, updating a security issue, or completing a scan, or a scheduled time based on a cron expression.
2. Conditions—a logical filter that determines whether the rule applies. Conditions use CEL (Common Expression Language), which supports complex operators, array aggregations, and time intervals.
3. Action—an operation that runs when the conditions are true. It includes CRUD operations on entities such as projects, layers, and vulnerabilities; scan management; notifications; and task creation in task trackers.

Adding a new policy

Adding a standard policy

To add a new policy, follow these steps:

1. Go to the Policies section.

2. Select Add policy.

3. In the window that opens, enter the following information:

   • policy name;
   • policy description;
   • scope, either the entire system or a single project.
   info

   You can also add project policies from projects. To do this, go to Projects → Project name → Policies, select Add policy, and follow the steps below.

4. In the If block, select the condition that should run the policy from the Trigger drop-down list.

5. In the Then block, specify the action that should run when the trigger activates.

   tip

   You can enter your own conditions in CEL or use system presets. To select a preset, select Apply preset (), and then select the required preset from the list.

   

6. Verify that the configuration is valid by selecting Check syntax. If the configuration is valid, the Configuration syntax is valid. No errors found. notification appears.

7. Select Create.

The new policy then appears in the list in the Policies section and runs according to the specified conditions.

Adding a cron policy

You can also add a policy that runs on a configured schedule. To do this:

1. Complete steps 1–3 in the previous instructions.

2. Select By schedule from the Trigger list.

3. Set one of the following schedule options:

   • one-time execution: enter the execution date in the DD/MM/YYYY HH:MM format;
   • recurring execution: turn on the Repeat toggle and enter a cron expression for running the policy.
   warning

   Time processing depends on the schedule type:

   • a cron expression schedule runs according to system time. If a user specifies a cron expression to run every day at 10:00 AM, the policy runs at 10:00 AM according to system time, regardless of the user's time zone;
   • a schedule based on a specific time and date runs according to the user's time, which converts to system time based on the user's time zone. For example, if a user configures the policy to run tomorrow at 10:00 AM, the policy runs tomorrow at 10:00 AM according to the user's time.

   For more information about cron expressions, see Configuring policy cron expressions.

   tip

   You can also use system presets to configure the schedule. To select a preset, select Apply preset (), and then select the required preset from the list.

   

4. Select the trigger that should run on the schedule.

5. In the Then block, specify the action that should run when the trigger activates.

6. Select Create.

The new policy then appears in the list in the Policies section and runs according to the specified conditions.

Editing a policy

To edit a policy, follow these steps:

1. Go to the Policies section.
2. Select the additional actions button () in the policy row.
3. Select Edit.
4. In the window that opens, change the required information.
5. Select Save.

The changed information then applies to the policy.

Configuring policy execution order

The system lets you configure the order in which active policies run.

To configure the policy order, follow these steps:

1. Go to the Policies section.
2. Select Change execution order.
3. In the window that opens, select the policy group parameters:
   • scope—the entire system or a project;
   • trigger—when you select a trigger, the actions that run when the trigger activates appear.
4. Move policies using the move button (). The button appears when you hover over a policy.
5. Select Save changes.

warning

Policies with the same trigger and scope run in the order defined for the policy group. Scheduled policies run independently and don't have an execution order.

The changed information then applies to the policy group.

Deleting policies

To delete one policy, follow these steps:

1. Go to the Policies section.
2. Select the additional actions button () in the policy row.
3. Select Delete.
4. Confirm that you want to delete the policy in the modal window that opens.

To delete multiple policies, follow these steps:

1. Select the required policies using the checkboxes ().
2. Select the delete button () above the policy table.
3. Confirm that you want to delete the policies in the modal window that opens.