Skip to main content
This document explains how to migrate existing policies to Unified Policies, create new policies, and manage existing ones.

​
Migrate existing policies

To migrate your existing legacy policies and use Unified Policies:
1
Sign in to Semgrep AppSec Platform.
2
Go to Rules & Policies > Policies. You will see a banner that prompts you to begin the upgrade to Unified Policies. Click to launch the Upgrade to Unified Policies dialog, and follow the on-screen prompts to proceed.
3
Review the policies that Semgrep has migrated for you. For each product where you have existing policies, select the I have reviewed these migration details checkbox to proceed.
4
When you have completed the migration process, you are redirected to the new Policies page, where you can manage your detection and remediation policies.

​
Create a remediation policy

1
Sign in to Semgrep AppSec Platform.
2
Go to Rules & Policies > Remediation.
3
To create a policy that defines the automated responses to security findings:
  1. Click + Create automation.
  2. Provide a Policy name. If Auto is enabled, this field auto-populates with a descriptive name based on the conditions and actions you define for the policy. Toggle to Auto-off to manually enter a name for the policy.
  3. Set the Scope of the policy by selecting all of the projects to which this policy applies. You can select all projects, select specific projects by name, or select specific projects by project tags.
  4. Define the Conditions that trigger the policy by clicking + Add condition to expand a drop-down list of attributes that you can use. Select the attribute, then set the specific conditions.
    • For example, you can select Severity, then complete the conditional statement provided to read When Severity is any of Critical, High.
    • You can define as many conditions as necessary, and Semgrep treats them additively.
  5. Choose the Actions that occur if there are findings that trigger the policy by clicking + Add action. You can choose multiple Actions, including:

    Block merge and comment on PR/MR

    Comment on PR/MR

    Create a Jira ticket

    Send a Slack message

    Call a webhook

    Require developer exception requests

  6. Click Create & Enable to save and proceed, so that Semgrep uses your new policy the next time you scan a project within its scope. Otherwise, click Create to save your changes without enabling the policy.

​
Configure default remediation policies

Some remediation policies are created for you by default and can’t be renamed or deleted. They can only be enabled and configured with the actions you choose. Supply Chain incidents, for example, use a dedicated policy called Early notification for Supply Chain incidents that already exists for your organization.
1
Go to Rules & Policies > Remediation, and find the default policy for the feature you want to configure. Click its icon, then click Edit policy.
2
Go to Actions, and add the Actions you want to occur when Semgrep identifies findings and the defined Conditions are met.
3
Click Update and enable to save and proceed, so that Semgrep uses your new policy the next time you scan a project within its scope. Otherwise, click Update to save your changes without enabling the policy.
See Supply Chain incident notifications and response for a complete walkthrough of the default Supply Chain incident policy.

​
Manage detection policies

1
Sign in to Semgrep AppSec Platform.
2
Go to Rules & Policies > Detection. Find the policy that you’d like to edit, and click Edit to open the editor. You can manage your policies for Code rules, Secrets rules, and Supply Chain licenses.
3
To modify your detection policy for:
1
Find the rules and rulesets you’d like to modify. Filters allow you to narrow the list of rules based on scanning behaviors, languages, rulesets, and more. You can also search for a rule using its name or label.
2
To change the behavior of your rules:
  1. Select the rules by clicking the checkboxes next to their names. Then, click Change scanning behavior (n). If you’re modifying only one rule, you can click the rule’s link in the Projects scanning column.
  2. The Projects scanning dialog appears. You can choose to use the rules with All projects, Selected projects by Project name, Selected projects by Tags, All with exceptions, or None (disable).
  3. To use the rules with all of your projects, click All projects, then click Save.
  4. To use the rules with some of your projects, click Selected projects, then click the checkboxes next to the projects to which the rule applies. Click Save to proceed.
  5. To exclude specific projects, click All with exceptions, then select the projects to which the rule doesn’t apply. Click Save to proceed.
  6. To prevent the rules from being used at all, click None (Disable), then Save to proceed.

​
Manage remediation policies

1
Sign in to Semgrep AppSec Platform.
2
Go to Rules & Policies > Remediation. You can manage your policies for individual Semgrep products, as well as those that apply to findings from multiple Semgrep products. For policies that apply to multiple products, the policies are triggered whenever the findings meet the criteria that you define.
3
Find the Remediation policy that you’d like to edit. Click its icon, then click Edit policy.
4
On the Edit policy page, you can:
  • Change the Policy name.
  • Choose the Event that triggers the policy.
  • Define the Scope, which is the set of projects to which the policy applies.
  • Define the Conditions that trigger the policy.
  • Choose the Actions that occur if there are findings that trigger the policy.
5
Click Update to save and proceed.