Policies for Snyk AppRisk
Overview
With Snyk AppRisk policies, you can easily automate the process of adding business context and receiving notifications.
After a policy is created, it is run in a maximum of 30 minutes after creation, then once every 30 minutes.
If your policy is set to run daily, then the policy is run 30 minutes after the 24-hour period ends. You can always manually run a policy by using the Run button.
Access the Snyk AppRisk policies by positioning yourself at the Group level, selecting Policies, then Assets.
The following video presents an overview of the types of policies you can create from the Policies view.
Use Cases
You can create policies for organizing the assets, classifying them, and always being up to date with the latest information about an asset. Common use cases for policies include:
New asset notifications
Notify members of the AppSec team when new assets meeting certain criteria are discovered. For example, you may send a Slack message to the infra team if new repository assets that leverage Terraform as a technology are detected by Snyk AppRisk.
Asset classification
Classify repository assets according to their business criticality from A (most critical) to D (least critical), based on asset properties such as name and tags. For example, you might indicate that any repositories that contain “customer-portal” in the name should be classified as A, given that the customer-portal app holds sensitive data.
Asset tagging
Categorize and label repository assets with flexible tags, which can be used to filter the asset inventory.
Security coverage
Monitor if your assets are scanned by the selected security products. You can select one or multiple security products and also specify a timeframe for when the last scan should have taken place.
Last updated