# Create policies

Snyk Essentials includes a powerful policy editor for creating and modifying policies.

There are two steps to building policies:

1. [Define filters](#define-filters) - Set filter conditions on asset properties.
2. [Set actions](#set-actions) - Define actions to be taken on filtered assets.

## New policy

You can create a new policy using the **Start from scratch** option or choose one of the available policy templates using the **Use a template** option.

<figure><img src="https://2533899886-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdwVZ6HOZriajCf5nXH%2Fuploads%2Fj682hIAXcvTQ57oQf37c%2FPolicy%20-%20new%20UI.png?alt=media&#x26;token=06ec8761-c377-476a-9bf5-528de03629bf" alt="Policy view, New policy button with the Start from scratch and Use a template options "><figcaption><p>Policy view, New policy options </p></figcaption></figure>

### Start from scratch - policy creation

To create a new policy, you have to click the **New Policy** option from the Policies/Assets view and select the **Start from scratch** option.

You must name your policy and, optionally, provide a description of the policy. After you complete these steps you have to [define the filters ](#define-filters)and [set the actions](#set-actions) of your policy.&#x20;

### Use a template - policy creation

You can create a new policy by using one of the available templates. To select one of the policy templates, you have to click the **New Policy** option from the Policies/Assets view and select the **Use a template** option. You can select one of the templates from the templates library by clicking the **Use template** button from the policy template card.&#x20;

Each policy template has a name, a description, and displays the graphic connections between filters and actions.

The following video explains how to use a policy template from the Policies view:

{% embed url="https://res.cloudinary.com/snyk/video/upload/v1737656948/snyk-learn/product-training-videos/Snyk_Essentials_and_Snyk_AppRisk_-5e_-_v1_-_Policy_Editor_Templates.mp4" %}
Overview of asset policy editor
{% endembed %}

You can customize the filters and actions or use the template as is. After finishing all the template changes, click the **Save** button to create the new policy.

<figure><img src="https://2533899886-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdwVZ6HOZriajCf5nXH%2Fuploads%2FseddFPCvRF1mdzy6KsZu%2FPolicy%20template%20-%20new%20UI.png?alt=media&#x26;token=40cca5a0-e856-4304-9c5a-66f531c5bf49" alt="Policy templates accesible from Policy view, New policy button, the Use a template option "><figcaption><p>Policy templates accesible from Policy view, New policy button, the Use a template option </p></figcaption></figure>

## **Define Filters**

{% hint style="info" %}
**Release status**

The risk factors on assets are taking the release status of the applied [risk factor](../../prioritize-issues-for-fixing/assets-and-risk-factors-for-snyk-apprisk/risk-factor-loaded-package).

The Runtime discovered and Runtime last seen filters are taking the release status of the used runtime [integration](../../../integrate-with-snyk/connect-a-third-party-integration).
{% endhint %}

The following video explains how to create a new policy:

{% embed url="https://res.cloudinary.com/snyk/video/upload/v1737656963/snyk-learn/product-training-videos/Snyk_Essentials_and_Snyk_AppRisk_-5b_-_v1_-_Policy_Editor.mp4" %}
Overview of asset policy editor
{% endembed %}

You must specify an asset property for each filter component. Navigate to the [Filters capabilities](../../../../manage-assets/assets-inventory-features#filters-capabilities) page to view all available properties for asset policies.&#x20;

Each property contains different options for conditions and values:

| Property                     | Conditions Values                                                                                                                         | Values                                                                                                                |
| ---------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------- |
| Application\*                | <ul><li>Is one of</li><li>Is not one of</li></ul>                                                                                         | all available applications for which you have configured the application context in Snyk Essentials                   |
| Asset ID                     | <ul><li>is</li><li>is not</li><li>contains</li><li>does not contain</li><li>starts with</li><li>ends with</li></ul>                       | \[string]                                                                                                             |
| Asset name                   | <ul><li>is</li><li>is not</li><li>contains</li><li>does not contain</li><li>starts with</li><li>ends with</li></ul>                       | \[string]                                                                                                             |
| Asset type                   | <ul><li>Is one of</li><li>Is not one of</li></ul>                                                                                         | <ul><li>Package</li><li>Repository</li><li>Scanned artifact</li></ul>                                                 |
| Attribute                    | <ul><li>is</li><li>is not</li><li>contains</li><li>does not contain</li><li>starts with</li><li>ends with</li></ul>                       | \[string]                                                                                                             |
| Catalog name\*               | <ul><li>Is one of</li><li>Is not one of</li></ul>                                                                                         | the list of names of your application context.                                                                        |
| Category                     | <ul><li>Is one of</li><li>Is not one of</li></ul>                                                                                         | the list of the available categories of a repository asset                                                            |
| Class                        | <ul><li>Is one of</li><li>Is not one of</li></ul>                                                                                         | A, B, C, D                                                                                                            |
| Clusters                     | <ul><li>containing one or more of</li><li>containing all of</li><li>not containing one or more of</li><li>not containing all of</li></ul> | the list of the available clusters                                                                                    |
| Coverage                     | <ul><li>containing one or more of</li><li>containing all of</li><li>not containing one or more of</li><li>not containing all of</li></ul> | Snyk Code, Container, IaC, Open Source                                                                                |
| Coverage gap                 | <ul><li>containing one or more of</li><li>containing all of</li><li>not containing one or more of</li><li>not containing all of</li></ul> | Snyk Code, Container, IaC, Open Source                                                                                |
| Developers                   | <ul><li>is</li><li>is not</li><li>contains</li><li>does not contain</li><li>starts with</li><li>ends with</li></ul>                       | \[string]                                                                                                             |
| Discovered                   | <ul><li>Is within</li><li>Is not within</li></ul>                                                                                         | <ul><li>Last 24 hours</li><li>Last 7 days</li><li>Last 30 days</li><li>Last 12 months</li><li>Year to date </li></ul> |
| <p></p><p>Issue severity</p> | <ul><li>containing one or more of</li><li>containing all of</li><li>not containing one or more of</li><li>not containing all of</li></ul> | <ul><li>Critical </li><li>High </li><li>Medium </li><li>Low</li></ul>                                                 |
| Issue source                 | <ul><li>containing one or more of</li><li>containing all of</li><li>not containing one or more of</li><li>not containing all of</li></ul> | Snyk Code, Container, IaC, Open Source, Nightfall                                                                     |
| Last seen                    | <ul><li>Is within</li><li>Is not within</li></ul>                                                                                         | <ul><li>Last 24 hours</li><li>Last 7 days</li><li>Last 30 days</li><li>Last 12 months</li><li>Year to date</li></ul>  |
| Lifecycle\*                  | <ul><li>Is one of</li><li>Is not one of</li></ul>                                                                                         | the available list of the lifecycle states of the application context component                                       |
| Locked attributes            | <ul><li>is one of</li><li>is not one of</li></ul>                                                                                         | <ul><li>Class</li></ul>                                                                                               |
| Owner\*                      | <ul><li>is one of</li><li>is not one of</li></ul>                                                                                         | the list of teams owning the repository for which the application context was configured.                             |
| Related package              | <ul><li>is</li><li>is not</li><li>contains</li><li>does not contain</li><li>starts with</li><li>ends with</li></ul>                       | \[string]                                                                                                             |
| Risk factors                 | <ul><li>containing one or more of</li><li>containing all of</li><li>not containing one or more of</li><li>not containing all of</li></ul> | the list of available risk factors                                                                                    |
| Runtime discovered           | <ul><li>Is within</li><li>Is not within</li></ul>                                                                                         | <ul><li>Last 24 hours</li><li>Last 7 days</li><li>Last 30 days</li><li>Last 12 months</li><li>Year to date</li></ul>  |
| Runtime last seen            | <ul><li>Is within</li><li>Is not within</li></ul>                                                                                         | <ul><li>Last 24 hours</li><li>Last 7 days</li><li>Last 30 days</li><li>Last 12 months</li><li>Year to date</li></ul>  |
| SCM Repository freshness     | <ul><li>is one of</li><li>is not one of</li></ul>                                                                                         | <ul><li>Active</li><li>Inactive</li><li>Dormant</li></ul>                                                             |
| Source                       | <ul><li>is one of</li><li>is not one of</li></ul>                                                                                         | <ul><li>azure-devops</li><li>GitHub</li><li>GitLab</li><li>Snyk</li></ul>                                             |
| Tags                         | <ul><li>containing one or more of</li><li>containing all of</li><li>not containing one or more of</li><li>not containing all of</li></ul> | all available tags you previously created                                                                             |
| Title\*                      | <ul><li>is one of</li><li>is not one of</li></ul>                                                                                         | the list with all the names of the component for which the application context was configured                         |

**\***&#x41;ll filters marked with `*` are visible only to the users who configured the application context for their SCM integrations.

You can specify more than one filter component with an **And** or **Or** operator.\


<figure><img src="https://2533899886-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdwVZ6HOZriajCf5nXH%2Fuploads%2FAifBlMVXD0tNXZB5xpAZ%2FCreate%20policy%20New%20UI.png?alt=media&#x26;token=fce67aab-731c-4851-b1a0-ee8f6a78ef69" alt="AppRisk - Create new policy"><figcaption><p>Asset policy - Create new policy</p></figcaption></figure>

The following video explains the use of filters and the use of the **And**, **Or** operator.&#x20;

{% embed url="https://res.cloudinary.com/snyk/video/upload/v1737656952/snyk-learn/product-training-videos/Snyk_Essentials_and_Snyk_AppRisk_-5c_-_v1_-_Policy_and_or_filters.mp4" %}
Using and/or operators in the asset policy editor
{% endembed %}

## **Set actions**

After defining filter components, you need to define the actions that the policy has to perform on the filtered assets. Asset policies support the following actions:

* **Send Email** - Receive an email every time there are asset updates. You can choose between daily emails or scheduling the checks. You can include a link to the relevant assets. Each notification lists all impacted assets. You can view them individually or see the aggregated view by clicking **Click Here**. The list of assets displayed in the email notification is automatically generated.
* **Send Slack Message** - Receive a Slack notification every time there are asset updates. You need to add your [Slack webhook URL](../../../integrate-with-snyk/jira-and-slack-integrations/slack-integration), then you can choose between daily emails or scheduling the checks. You can include a link to the relevant assets. Each notification lists all impacted assets. You can view them individually or see the aggregated view by clicking **Click Here**. The list of assets displayed in the email notification is automatically generated.
* **Set Asset Class** - Sets the class on the matched assets. Removing the policy or turning in off does not retroactively change the asset class back to default.
* **Set Asset Tag** - Sets a tag on the matched assets. Removing the policy or turning in off will remove the tags of this policy from the relevant assets.
* **Set Coverage Control Policy** - Sets a control on filtered assets that checks whether selected security products are scanning assets, optionally within a given timeframe. Assets that fail this control will be marked accordingly on inventory pages. This control applies the OR logic across products.

<figure><img src="https://2533899886-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdwVZ6HOZriajCf5nXH%2Fuploads%2FE06zZpqSfYAZ8FV2qAAV%2FPolicy%20-%20Nwe%20UI.png?alt=media&#x26;token=73eb75d9-7680-4d1d-9fad-c14a62ed0995" alt="AppRisk - Set a policy action"><figcaption><p>Asset policy - Set a policy action </p></figcaption></figure>

The editor supports multiple flows for the same policy. The flows can be independent or intersect.

<figure><img src="https://2533899886-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdwVZ6HOZriajCf5nXH%2Fuploads%2FH2P7l7BkjgYs8PaMGfIs%2FMultiple%20actions%20-%20New%20UI.png?alt=media&#x26;token=3a43dc09-b2e2-4e87-9056-8dab5327675a" alt="AppRisk - Set multiple policy actions "><figcaption><p>Asset Policy- Set multiple policy actions </p></figcaption></figure>
