Contrib/dzion - create-appsec-rules by DorZion51 · Pull Request #42981 · demisto/content

DorZion51 · 2026-02-09T13:32:43Z

Contributing to Cortex XSOAR Content

Make sure to register your contribution by filling the contribution registration form

The Pull Request will be reviewed only after the contribution registration form is filled.

Status

In Progress
Ready
In Hold - wait to DR +DEMO

Related Issues

https://jira-dc.paloaltonetworks.com/browse/BCE-56629
https://jira-dc.paloaltonetworks.com/browse/CRTX-226145

Description

Requesting module : CAS

Operational Use Case: Enables automated creation of custom Application Security rules to detect secrets (API keys, credentials) and IaC misconfigurations across the application lifecycle, eliminating manual rule creation and ensuring consistent security policy enforcement.

Scope of Contribution:

New Script: CreateAppsecRule – Underlying automation script.
New Action: CreateSecretAppsecRule – For secrets detection rules.
New Action: CreateIACAppsecRule – For Infrastructure-as-Code security rules.
Enhancement Agent: Application Security Agent
Technical Details
API Endpoint: /api/webapp/public_api/appsec/v1/rules **

HTTP Method: POST

Endpoint Docs

Wrapper Command: core-generic-api-call

Inputs/Parameters:

rule_name (required): Unique rule name.
severity (required): CRITICAL, HIGH, MEDIUM, LOW
scanner (required): SECRETS or IAC
category (required): Scanner-specific categories (8 for SECRETS, 9 for IAC)
sub_category (required for IAC): Granular classification
frameworks (required): JSON array with name, definition, remediationDescription
description (optional): Rule description
labels (optional): Comma-separated labels
Outputs:

Appsec.Rule.RULE_NAME: Created rule name
Full rule object in context
Target Supported License:
Valid modules for this action:

agentix
xsiam
cloud_posture
cloud_appsec

Must have

Tests
Documentation

relates: https://jira-dc.paloaltonetworks.com/browse/CIAC-15801

CLAassistant · 2026-02-09T13:32:49Z

All committers have signed the CLA.

content-bot · 2026-02-09T13:35:28Z

Thank you for your contribution. Your generosity and caring are unrivaled! Make sure to register your contribution by filling the Contribution Registration form, so our content wizard @kamalq97 will know the proposed changes are ready to be reviewed.
For your convenience, here is a link to the contributions SLAs document.

content-bot · 2026-02-09T13:35:31Z

Hi @DorZion51, thanks for contributing to the XSOAR marketplace. To receive credit for your generous contribution please follow this link.

content-bot · 2026-02-09T13:35:32Z

🤖 AI-Powered Code Review Available

Hi @kamalq97, you can leverage AI-powered code review to assist with this PR!

Available Commands:

@content-bot start review - Initiate a full AI code review
@content-bot re-review - Incremental review for new commits

…required , change script to add uniqness to rule name

… contrib/dzion-CreateAppSecRules

…DorZion51/demisto-content into contrib/dzion-CreateAppSecRules

mayyagoldman · 2026-03-16T15:05:36Z

Packs/CAS/AgentixActions/CreateSecretAppsecRule.yml

+  version: -1
+name: CreateSecretAppsecRule
+display: CAS - Create Secret Appsec Rule 
+description: Creates a new Application Security rule in Cortex Platform. An AppSec rule defines the specific criteria and scanners used to detect vulnerabilities or misconfigurations across your application lifecycle.


Suggested change

description: Creates a new Application Security rule in Cortex Platform. An AppSec rule defines the specific criteria and scanners used to detect vulnerabilities or misconfigurations across your application lifecycle.

description: Creates a new Secret Application Security rule in Cortex Platform. An AppSec rule defines the specific criteria and scanners used to detect vulnerabilities or misconfigurations across your application lifecycle.

mayyagoldman · 2026-03-16T15:05:49Z

Packs/CAS/AgentixActions/CreateIACAppsecRule.yml

+  version: -1
+name: CreateIACAppsecRule
+display: CAS - Create Iac Appsec Rule 
+description: Creates a new Application Security rule in Cortex Platform. An AppSec rule defines the specific criteria and scanners used to detect vulnerabilities or misconfigurations across your application lifecycle.


Suggested change

description: Creates a new Application Security rule in Cortex Platform. An AppSec rule defines the specific criteria and scanners used to detect vulnerabilities or misconfigurations across your application lifecycle.

description: Creates a new IAC Application Security rule in Cortex Platform. An AppSec rule defines the specific criteria and scanners used to detect vulnerabilities or misconfigurations across your application lifecycle.

Packs/CAS/AgentixActions/CreateIACAppsecRule.yml

mayyagoldman · 2026-03-16T15:08:17Z

Packs/CAS/AgentixActions/CreateIACAppsecRule.yml

+- name: rule_name
+  underlyingargname: rule_name
+  description: >
+    Must be unique if exist generate new one


Suggested change

Must be unique if exist generate new one

mayyagoldman · 2026-03-16T15:09:15Z

Packs/CAS/AgentixActions/CreateIACAppsecRule.yml

+  underlyingargname: rule_name
+  description: >
+    Must be unique if exist generate new one
+    A unique name for the AppSec rule following the organization's naming conventions.


Suggested change

A unique name for the AppSec rule following the organization's naming conventions.

A unique name for the AppSec rule.

mayyagoldman · 2026-03-16T15:21:50Z

Packs/CAS/Scripts/CreateAppsecRule/CreateAppsecRule.py

+
+        else:
+            context = res[0]["EntryContext"]
+            data = context.get("data")


Suggested change

data = context.get("data")

data = context.get("data" , {})

mayyagoldman · 2026-03-16T15:22:38Z

Packs/CAS/Scripts/CreateAppsecRule/CreateAppsecRule.py

+                CommandResults(
+                    outputs_prefix="Appsec.Rule",
+                    outputs=data,
+                    readable_output=f"Rules {data}",


Suggested change

readable_output=f"Rules {data}",

Packs/CAS/Scripts/CreateAppsecRule/CreateAppsecRule.yml

Packs/CAS/pack_metadata.json

…ntrib/dzion-CreateAppSecRules

Packs/CAS/Scripts/CreateAppsecRule/CreateAppsecRule.yml

Packs/CAS/AgentixActions/CreateSecretAppsecRule.yml

Packs/CAS/AgentixActions/CreateIACAppsecRule.yml

Packs/CAS/AgentixActions/CreateSecretAppsecRule.yml

Co-authored-by: Maya Goldman <94686128+mayyagoldman@users.noreply.github.com>

…ntrib/dzion-CreateAppSecRules

DorZion51 added 13 commits January 26, 2026 15:48

add rule script

6f4b11d

try

3d2de08

add action and script

60e109c

try

ec6bedc

revert core

8f693ce

add framework

759134e

fix input

c8cdd1d

fix

fae99a2

finish actions for Iac and secrets

b41b2b9

fix appsec

7071ea5

finish actions and script

07ed3b1

change list to array

0816d14

fix definition

f7bf160

DorZion51 requested a review from JudahSchwartz as a code owner February 9, 2026 13:32

content-bot added Contribution Thank you! Contributions are always welcome! External PR Xsoar Support Level Indicates that the contribution is for XSOAR supported pack labels Feb 9, 2026

content-bot changed the base branch from master to contrib/DorZion51_contrib/dzion-CreateAppSecRules February 9, 2026 13:35

content-bot assigned kamalq97 Feb 9, 2026

content-bot requested a review from kamalq97 February 9, 2026 13:35

DorZion51 added 2 commits February 9, 2026 15:39

clean script

60ea7aa

remove files

5561b8f

kamalq97 assigned JudahSchwartz and unassigned kamalq97 Feb 9, 2026

kamalq97 removed their request for review February 9, 2026 13:46

change require to approval to true and frameworks and description to …

ea8ef45

…required , change script to add uniqness to rule name

add generatable

2aa0b3e

ShahafBenYakir requested review from dantavori and omerKarkKatz February 16, 2026 07:45

DorZion51 and others added 3 commits February 16, 2026 10:15

Merge branch 'contrib/DorZion51_contrib/dzion-CreateAppSecRules' into…

9dca05b

… contrib/dzion-CreateAppSecRules

add generatable

9aff21e

Merge branch 'contrib/dzion-CreateAppSecRules' of https://github.com/…

1450cc1

…DorZion51/demisto-content into contrib/dzion-CreateAppSecRules

mayyagoldman self-requested a review March 2, 2026 10:49

mayyagoldman requested changes Mar 16, 2026

View reviewed changes

Merge branch 'master' of github.com:DorZion51/demisto-content into co…

86faf7e

…ntrib/dzion-CreateAppSecRules

mayyagoldman reviewed Mar 16, 2026

View reviewed changes

DorZion51 and others added 4 commits March 16, 2026 18:00

resolved issues

8b4b7c9

Apply suggestions from code review

e8e4c6e

Co-authored-by: Maya Goldman <94686128+mayyagoldman@users.noreply.github.com>

Apply suggestions from code review

b3f3e59

Co-authored-by: Maya Goldman <94686128+mayyagoldman@users.noreply.github.com>

fix supported modules

c67487a

DorZion51 force-pushed the contrib/dzion-CreateAppSecRules branch from bfa5981 to c67487a Compare March 16, 2026 16:14

DorZion51 added 2 commits March 16, 2026 18:19

Merge branch 'master' of github.com:DorZion51/demisto-content

bc2ce8d

Merge branch 'master' of github.com:DorZion51/demisto-content into co…

43b8893

…ntrib/dzion-CreateAppSecRules

DorZion51 requested a review from mayyagoldman March 17, 2026 10:10

merit-maita closed this Mar 18, 2026

merit-maita reopened this Mar 18, 2026

mayyagoldman approved these changes Mar 18, 2026

View reviewed changes

merit-maita closed this Mar 18, 2026

merit-maita reopened this Mar 18, 2026

	description: Creates a new Application Security rule in Cortex Platform. An AppSec rule defines the specific criteria and scanners used to detect vulnerabilities or misconfigurations across your application lifecycle.
	description: Creates a new Secret Application Security rule in Cortex Platform. An AppSec rule defines the specific criteria and scanners used to detect vulnerabilities or misconfigurations across your application lifecycle.

	description: Creates a new Application Security rule in Cortex Platform. An AppSec rule defines the specific criteria and scanners used to detect vulnerabilities or misconfigurations across your application lifecycle.
	description: Creates a new IAC Application Security rule in Cortex Platform. An AppSec rule defines the specific criteria and scanners used to detect vulnerabilities or misconfigurations across your application lifecycle.

	A unique name for the AppSec rule following the organization's naming conventions.
	A unique name for the AppSec rule.

Conversation

DorZion51 commented Feb 9, 2026 • edited by merit-maita Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Contributing to Cortex XSOAR Content

Status

Related Issues

Description

Must have

Uh oh!

CLAassistant commented Feb 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

content-bot commented Feb 9, 2026

Uh oh!

content-bot commented Feb 9, 2026

Uh oh!

content-bot commented Feb 9, 2026

🤖 AI-Powered Code Review Available

Uh oh!

mayyagoldman Mar 16, 2026

Choose a reason for hiding this comment

Uh oh!

mayyagoldman Mar 16, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

mayyagoldman Mar 16, 2026

Choose a reason for hiding this comment

Uh oh!

mayyagoldman Mar 16, 2026

Choose a reason for hiding this comment

Uh oh!

mayyagoldman Mar 16, 2026

Choose a reason for hiding this comment

Uh oh!

mayyagoldman Mar 16, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

DorZion51 commented Feb 9, 2026 •

edited by merit-maita

Loading

CLAassistant commented Feb 9, 2026 •

edited

Loading