Policies for asset management and discovery with Snyk Essentials and Snyk AppRisk

Asset policies is found at the Group level, under Policies, as a policy tab. Asset policies allow companies to specify rules such that, based on triggers and metadata fields, actions can be defined and executed.

For example,

• if a new repository is added without Snyk coverage, slack or email can trigger a message.
• Assets can automatically be tagged or classified based on provided criteria

For prototyping policy matches, see criteria examples and how to use inventory in the Inventory lesson.

To create a policy, click Policy on the left hand menu, then select the Asset tab at the top.

Policies generally fall under four categories

• Sending a notification via Email or Slack
• Setting a tag that assists with filtering or defining policies
• Setting a classification, indicating the importance of an application
• Setting a coverage policy to determine what controls are run and, optionally, frequency they must be run

You can find common policy examples and suggested settings in the documentation for Policy use-cases. Click the links on this page for more information about the relevant use cases

The following videos provide examples and tips for creating policies.

• Policy overview video: 3m16s

• Asset Policy editor video (3m52s)

• Asset Policy editor - And/Or operators for filters video: 1m58s

• Policy editor - Asset coverage policy example video: 1m59s

• Policy templates - created by Snyk for common policies and best practices. Learn how to use a policy template video: 1m25s

• When creating policies checking for the use of Snyk Code or Snyk Open Source, be clear on the use case. Is it:
  • Coverage you are typically looking if all tools are in use
  • Coverage gaps are typically where one or more are not in use
• Don't forget to filter by asset-type=repository in most cases. If you're using OR operators in your rules you may need to create a higher level block to nest a rule with an OR in it.
• Repository Name is using the Asset Name option when selecting "Contains" or "Not Contains"
• The URL for a repository is identified by the Attribute when asset-type=repository
• The default rescan for Snyk Open Source is one day, whereas Snyk Code is one week, however, note that a rescan will take place when pullrequest/mergerequest are merged, provided the webhook for the associated PR check is present. Due to the different default rescan schedule, it potentially necessitates two policies being created for coverage.

See documentation for common implementation examples of policies:

• Policy use-cases