Policies

A policy is a configurable rule for automating DevSecOps processes based on an event-driven model. It allows the system to respond to internal events or run on a schedule while performing specified actions on system entities.

A policy consists of three sequential components:

1. Trigger—the event that activates the policy. This event can be a change to an entity, such as creating a project, updating a security issue, or completing a scan, or a scheduled time specified by a cron expression.
2. Conditions—a logical filter that determines whether the rule applies.
3. Action—the operation that runs when the conditions are true. It includes CRUD operations on entities such as projects, layers, and vulnerabilities, scan management, notifications, and task creation in task trackers.

info

Policy conditions use CEL (Common Expression Language), which supports complex operators, array aggregations, and time intervals. For more information about CEL syntax, see the CEL repository documentation.

Add a new policy

Add a standard policy

To add a new policy, follow these steps:

1. Go to the Policies section.

2. Select Add policy.

3. In the window that opens, enter the following information:

   • policy name;
   • policy description;
   • scope, either the entire system or one project.
   info

   You can also add project policies from a project. Go to Projects → Project name → Policies, select Add policy, and follow the steps below.

4. Select the condition that should run the policy from the Trigger drop-down list in the If block.

5. Specify the action that should run when the trigger activates in the Then block.

   tip

   You can enter your own conditions in CEL or use system presets. To select a preset, select Apply preset () and select the required preset from the list.

   

6. Verify that the configuration is correct by selecting Check syntax. If the configuration is valid, the Configuration syntax is valid. No errors found. notification appears.

7. Select Create.

The system then displays the new policy in the Policies section, where it runs according to the specified conditions.

Add a cron policy

You can also add a policy that runs on a configured schedule. To do this:

1. Follow steps 1–3 in the previous instructions.

2. Select By schedule from the Trigger list.

3. Set one of the following schedule options:

   • one-time run: specify the execution date in the DD/MM/YYYY HH:MM format;
   • recurring schedule: turn on the Repeat toggle and enter a cron expression for running the policy.
   warning

   Time processing depends on the schedule type:

   • a cron expression schedule uses system time. If a user specifies a cron expression to run the policy every day at 10:00, the policy runs at 10:00 system time, regardless of the user's time zone;
   • a specific date and time schedule uses the user's time, which the system converts to system time using the user's time zone. For example, if a user schedules the policy to run tomorrow at 10:00, the policy runs tomorrow at 10:00 the user's time.

   For more information about cron expressions, see Configure policy cron expressions.

   tip

   You can also use system presets to configure the schedule. To select a preset, select Apply preset () and select the required preset from the list.

   

4. Select the trigger that should run on schedule.

5. Specify the action that should run when the trigger activates in the Then block.

6. Select Create.

The system then displays the new policy in the Policies section, where it runs according to the specified conditions.

Edit a policy

To edit a policy, follow these steps:

1. Go to the Policies section.
2. Select the additional actions button () in the policy row.
3. Select Edit.
4. In the window that opens, change the required information.
5. Select Save.

The system then applies the changes to the policy.

Configure policy execution order

You can configure the order in which active policies run in the system.

To configure the policy order, follow these steps:

1. Go to the Policies section.
2. Select Change execution order.
3. In the window that opens, select the policy group parameters:
   • scope—the entire system or a project;
   • trigger—when you select a trigger, the actions that run when the trigger activates appear.
4. Move policies using the move button (), which appears when you hover over a policy.
5. Select Save changes.

warning

Policies with the same trigger and same scope run in the order specified for the policy group. Scheduled policies run independently and don't have an execution order.

The system then applies the changes to the policy group.

Delete policies

To delete one policy, follow these steps:

1. Go to the Policies section.
2. Select the additional actions button () in the policy row.
3. Select Delete.
4. Confirm the policy deletion in the modal window that opens.

To delete multiple policies, follow these steps:

1. Select the required policies using the checkboxes ().
2. Select the delete button () above the policy table.
3. Confirm the policy deletions in the modal window that opens.