# Global Policies

The **Policies** tab is used to customize policies at a global level. The pre-defined deployment firewall rules that are listed can be customized as per your requirement using this tab. The severity, action and status of the rule can be changed as needed. The changes made in the rules are reflected across all the applications connected to Delivery Shield. 

### To View the Rules:

Navigate to **Policies** tab. The Rules Config details page is displayed. The top panel displays the various stages such as **Source**, **Build**, **Artifact** and **Deploy**. 

On clicking each stage, the corresponding rules are displayed. 

<figure><img src="/files/tD5Zu5lNH5W99f997fRR" alt=""><figcaption></figcaption></figure>

The following details of the rules are displayed after the panel:

* **Rule :** Displays the name of the rule.
* **Tag :** Displays the related tags for the rule. The tags indicate to which security framework the rules are complied with. You can also add [user-defined tags](#to-add-tags).
* **Stage :** Displays the stage for which the rule is created.&#x20;
* **Category :** Displays the category of the rule.&#x20;
* **Severity :** Displays the severity or impact of the rule namely **Major**, **Critical** or **Normal.**&#x20;
* **Action :** Displays whether the rule displayed is set as an **Alert** or **Prevent.** If the action is set to alert, when the rule fails an alert is generated but the deployment succeeds. Similarly, if the action is set to prevent, when the rule fails the deployment will be blocked and an alert will be generated.
* **Description :** Displays the description of the rule.&#x20;
* **Status :** Displays whether the rule is enabled or disabled. You can **Enable** or **Disable** the rule for the selected application by clicking the **Status** radio button. If the rule is enabled, the status button is green in color.&#x20;

### To Customize the Rules:

The displayed rules can be customized as per your requirement.  The **Severity** and **Status** field for an individual rule or a set of rules can be customized.&#x20;

#### To Customize Individual Rules

* Select the rule for which you wish to change the severity or status field.
* Click the **Severity** drop down to change the severity of the rule and **Action** drop down to change the rule to be an alert or prevent.&#x20;

<figure><img src="/files/dBEmNjKmdzqrO1lGFelx" alt=""><figcaption></figcaption></figure>

* Click **Save Changes** to save the modifications. A popup appears.
* Choose **New Applications** to apply this change for the newly added applications. ( The changes will reflect to the applications that are added after the modifications are saved only).&#x20;
* Choose **Both Existing and New Applications** to apply this change to existing applications as well as newly added applications.

<figure><img src="/files/4l4WlOOeJhpaHhrpsV39" alt=""><figcaption></figcaption></figure>

* Click **Save Changes**. The changes to the rules are saved.&#x20;

#### To Customize a Set of Rules

* Click **Bulk Edit**.

<figure><img src="/files/z22WqJ1bUcF5lGJH6siu" alt=""><figcaption></figcaption></figure>

* Select the rules you need to modify.&#x20;
* Click the **Update Action** drop down to change the action of the rule.&#x20;

<figure><img src="/files/WUmJo9r92A4iVpXs9VjF" alt=""><figcaption></figcaption></figure>

* Click the **Update Status** drop down to change the status of the rules. Select **Enable All** to enable the selected rules and **Disable All** to disable the selected rules.&#x20;

<figure><img src="/files/ThL4r4t8wAxzkMEr7N1v" alt=""><figcaption></figcaption></figure>

* Click **Save Changes** to save the modifications. A popup appears.
* Choose **New Applications** to apply this change for the newly added applications. ( The changes will reflect to the applications that are added after the modifications are saved only).&#x20;
* Choose **Both Existing and New Applications** to apply this change to existing applications as well as newly added applications.

<figure><img src="/files/HreYk2vx1uEU7dL7DtcR" alt=""><figcaption></figcaption></figure>

* Click **Save Changes**. The changes to the rules are saved.

### To Add Tags:

You can add your customized tags to the **Tags** column.&#x20;

* Select the rule for which you want to add tags.
* Click the tags as the arrow indicates in the image below:

<figure><img src="/files/ggFJ9RTFUoFrYfJmXdgy" alt=""><figcaption></figcaption></figure>

* A popup to add tags is displayed. Add the required tag in the **Add a Tag** column.&#x20;

<figure><img src="/files/9BjXCMMj4NULC2zOJqbS" alt=""><figcaption></figcaption></figure>

* A message as shown in the image below appears once you add a tag.&#x20;

<figure><img src="/files/Aw2FNKgEIj4Jw7fXrR8v" alt=""><figcaption></figcaption></figure>

* Press **Enter**. The tag gets added and a message **(Successfully saved)** is displayed as shown below:

<figure><img src="/files/CEzn68V8sNHwFURgq2g5" alt=""><figcaption></figcaption></figure>

* To delete the added tags, click on the space near the tags. The popup appears listing the available tags.&#x20;
* Click on the '**x'** mark provided near the added tags.&#x20;

<figure><img src="/files/g8GF3u0P2yz0v0kFDa7I" alt=""><figcaption></figcaption></figure>

* The tag gets deleted and a message **(Successfully unassigned)** is displayed as shown below:&#x20;

<figure><img src="/files/0bujuESyg0KZOPGbJf3k" alt=""><figcaption></figcaption></figure>

{% hint style="info" %}
Only user defined tags can be deleted.&#x20;
{% endhint %}

{% hint style="info" %}
The **Severity** and **Action** of the rules can only be changed at the global level. Enabling or disabling individual rules for specific applications and environments can be done at each application level. Refer [Policies](https://docs.opsmx.com/opsmx-delivery-shield-platform/user-guide/view-security-posture/application-security-posture/policies) for more details.&#x20;
{% endhint %}

### Smart Search

The smart search option available in this page, helps you to search the available **Rules** based on Action, Severity, Stage, Status, Policy and Tags.&#x20;

The following example shows how to search for rules based on Tags.&#x20;

* Select **Tags** from the search drop dow&#x6E;**.** The various tags that are available are displayed. Select the checkbox near the tag for which you want to filter the assigned rules.&#x20;

<figure><img src="/files/3urJuuhpMbpEE2c87bKp" alt=""><figcaption></figcaption></figure>

* The rules associated with the selected tags are displayed.&#x20;

<figure><img src="/files/mqGSoQUF5049EltyIaxm" alt=""><figcaption></figcaption></figure>

### Sync Policies&#x20;

The Sync Policies option is a feature added to the page. This option allows users to create user-defined rules. To create user rules, you need to integrate **Custom Policy Source** in Delivery Shield, as shown below:

### To Integrate Custom Policy Source&#x20;

To Integrate Custom Policy Source:

1. Navigate to **Config** > **Integrations**.
2. In the **Others** panel, click on **Custom Policy Source**.

<figure><img src="/files/0QDvhZJbhKjBzg1yYNKQ" alt=""><figcaption></figcaption></figure>

3. The **Custom Policy Source** integration page is displayed.
4. Enter the **Repo URL & Path** and **Token** value of your custom policy source account.

<figure><img src="/files/9PNWR3Wrpx5jRFV57Wsn" alt=""><figcaption></figcaption></figure>

3. Click **Save**. The tool is integrated.&#x20;
4. You can edit the entered values by clicking the **Edit** option as shown below:

<figure><img src="/files/XGPDxEkQCK6MIDLmMFAF" alt=""><figcaption></figcaption></figure>

7. Enter the new **Repo URL & Path** and **Token** value and click **Update**.&#x20;

<figure><img src="/files/OOZE7hzkAaQZq4WOqV9e" alt=""><figcaption></figcaption></figure>

The new values get updated.&#x20;

### To Create Rules:

Go to your Github path that was added to the Delivery Shield secret. Create the required rule with the following fields as given below:

* **Rule name**: The name of the created rule.&#x20;
* **Rule Severity**: The severity of the rule, namely: Low, Medium, and High.
* **Rule Action**: The rule type, Alert or Prevent.&#x20;
* **Rule Description**: A description of the created rule.&#x20;
* **Variables**: The set of system defined values used to validate the policy. For example: github\_repo\_visibility
* **Rule Stage**: The stage in which the rule needs to be applied, namely: Source, Build, Artifact and Deploy, .&#x20;
* **Rule**: The rule script, ( a rego-based script). &#x20;

{% hint style="info" %}
Rego is a query language used for defining policy that is easy to read and write. See [Policy Language](https://www.openpolicyagent.org/docs/latest/policy-language/) for more details.&#x20;
{% endhint %}

The rule gets added. You can create any number of rules.&#x20;

A sample user defined policy or rule is given below. This rule indicates that the github repository should not be publicly visible and also public repositories should not be allowed.

```
ruleName: Github Repo Visibility Validation Policy
ruleSeverity: Medium
ruleAction: Alert
ruleDescription: Github Repository must not be publically visible
variables: github_repo_visibility
ruleStage: Source
rule: |
    package opsmx
    
    deny[msg] {
          checkvisibility := inpu.github_repo_visibility
          checkvisibility == "public"
          msg + "Public repositories are not allowed"
          
    }
```

#### To Access the User-Defined Rules:

The created rules need to be synced in order to be applied in the deployment stages. Follow the steps provided below to sync the created rules:

* Navigate to **Deployment Firewall** > **Rules Config**.
* Click the **Sync Policies** option present at the top right corner of the **Rules Config** page.

<figure><img src="/files/Sism2daCwTctbdCReRbB" alt=""><figcaption></figcaption></figure>

* The **Sync Policies** page is displayed with the list of policies created by the user.&#x20;

<figure><img src="/files/UALdwlA4Uz1YN6oo0QPe" alt=""><figcaption></figcaption></figure>

* Click **Sync**. The user-defined rules get synced and gets added to the rule list.

If there are any errors in the values added to the fields, the rules cannot be synced and shows sync error as shown below:

<figure><img src="/files/Bg5IFPwMbnMBM4776lu2" alt=""><figcaption></figcaption></figure>

A tag named **User Defined Policies** is added to the Tags column once the user defined rules are synced. You can search for the rules using this tag option.

{% hint style="info" %}
The user-defined rules can only be edited in the source git repository. Sync the rules to update the changes.
{% endhint %}

<br>


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.opsmx.com/opsmx-1/opsmx-delivery-shield-platform/user-guide/manage-policies/global-policies.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.