> ## Documentation Index
> Fetch the complete documentation index at: https://docs.endorlabs.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Action policy templates

> Learn about the predefined action policy templates and how to customize them.

export const YamlTable = ({children, data: propData, content}) => {
  const KV_RE = /^([A-Za-z][A-Za-z0-9_()/#\s-]+?):\s*(.+)$/;
  const INLINE_MD_RE = /(\[([^\]]+)\]\(([^)]+)\))|(`([^`]+)`)|(\*\*([^*]+)\*\*)|(\*([^*]+)\*)/g;
  const YES_RE = /^-yes-$/i;
  const NO_RE = /^-no-$/i;
  const LIMITED_RE = /^-(limited|partial)-$/i;
  const NA_RE = /^-(na|none)-$/i;
  const NA2_RE = /^-na2-$/i;
  const SIMPLE_TAG_RE = /(<br\s*\/?>)|(<p\s*\/?>)|(-note-)|(-warning-)/gi;
  const renderSuccessIcon = () => <svg viewBox="0 0 24 24" width="100%" height="100%" aria-hidden="true">
      <path d="M12 2C6.48 2 2 6.48 2 12C2 17.52 6.48 22 12 22C17.52 22 22 17.52 22 12C22 6.48 17.52 2 12 2ZM10 17L5 12L6.41 10.59L10 14.17L17.59 6.58L19 8L10 17Z" fill="currentColor" />
    </svg>;
  const renderFailureIcon = () => <svg viewBox="0 0 24 24" width="100%" height="100%" aria-hidden="true">
      <path fillRule="evenodd" clipRule="evenodd" d="M11.9902 1.98633C12.5208 1.9864 13.0426 2.12743 13.501 2.39453C13.9581 2.66107 14.3372 3.04388 14.5986 3.50391L22.5967 17.5L22.6895 17.6738C22.8921 18.0851 22.9979 18.5387 22.9981 18.999C22.9981 19.5253 22.8605 20.0431 22.5977 20.499C22.3348 20.9549 21.9555 21.3332 21.5 21.5967C21.0445 21.8601 20.5272 21.9994 20.001 22H4.00001C3.47453 22.0031 2.95699 21.868 2.50001 21.6084C2.04032 21.3471 1.65712 20.9684 1.39063 20.5117C1.12431 20.055 0.983643 19.5355 0.982429 19.0068C0.981281 18.4793 1.11967 17.9611 1.38282 17.5039L9.38184 3.50391C9.64344 3.04359 10.023 2.66111 10.4805 2.39453C10.9388 2.12755 11.4598 1.98636 11.9902 1.98633ZM12 16.9004C11.3925 16.9004 10.9004 17.3925 10.9004 18C10.9004 18.6075 11.3925 19.0996 12 19.0996H12.0098C12.6173 19.0996 13.1104 18.6075 13.1104 18C13.1104 17.3925 12.6173 16.9004 12.0098 16.9004H12ZM12 5.90039C11.3925 5.9004 10.9004 6.39249 10.9004 7V13C10.9004 13.6075 11.3925 14.0996 12 14.0996C12.6075 14.0996 13.0996 13.6075 13.0996 13V7C13.0996 6.39249 12.6075 5.90039 12 5.90039Z" fill="currentColor" />
    </svg>;
  const renderPartialSuccessIcon = () => <svg viewBox="0 0 24 24" width="100%" height="100%" aria-hidden="true">
      <path d="M12 1C18.0751 1 23 5.92487 23 12C23 18.0751 18.0751 23 12 23C5.92487 23 1 18.0751 1 12C1 5.92487 5.92487 1 12 1ZM12 3C7.02944 3 3 7.02944 3 12C3 16.9706 7.02944 21 12 21C16.9706 21 21 16.9706 21 12C21 7.02944 16.9706 3 12 3ZM12 5C13.8565 5 15.6374 5.73705 16.9502 7.0498C18.263 8.36256 19 10.1435 19 12C19 13.8565 18.263 15.6374 16.9502 16.9502C15.6374 18.263 13.8565 19 12 19C11.4477 19 11 18.5523 11 18V6C11 5.73478 11.1054 5.4805 11.293 5.29297C11.4805 5.10543 11.7348 5 12 5Z" fill="currentColor" />
    </svg>;
  const renderPendingIcon = () => <svg viewBox="0 0 24 24" width="100%" height="100%" fill="none" stroke="currentColor" strokeWidth="2" strokeLinecap="round" aria-hidden="true">
      <path d="M10.1 2.182a10 10 0 0 1 3.8 0" />
      <path d="M13.9 21.818a10 10 0 0 1-3.8 0" />
      <path d="M17.609 3.721a10 10 0 0 1 2.69 2.7" />
      <path d="M2.182 13.9a10 10 0 0 1 0-3.8" />
      <path d="M20.279 17.609a10 10 0 0 1-2.7 2.69" />
      <path d="M21.818 10.1a10 10 0 0 1 0 3.8" />
      <path d="M3.721 6.391a10 10 0 0 1 2.7-2.69" />
      <path d="M6.391 20.279a10 10 0 0 1-2.69-2.7" />
    </svg>;
  const renderRunningIcon = () => <svg className="yt-status-running-svg" viewBox="22 22 44 44" width="100%" height="100%" aria-hidden="true">
      <circle className="yt-status-running-circle" cx="44" cy="44" r="20.2" fill="none" stroke="currentColor" strokeWidth="3.6" />
    </svg>;
  const renderSkippedIcon = () => <svg viewBox="0 0 24 24" width="100%" height="100%" fill="none" stroke="currentColor" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" aria-hidden="true">
      <circle cx="12" cy="12" r="10" />
      <path d="M8 12h8" />
    </svg>;
  const STATUS_ICON_DEFS = [{
    re: /^-status-success-$/i,
    colorClass: 'yt-status-color-success',
    label: 'Success',
    render: renderSuccessIcon
  }, {
    re: /^-status-failure-$/i,
    colorClass: 'yt-status-color-failure',
    label: 'Failure',
    render: renderFailureIcon
  }, {
    re: /^-status-partial-success-$/i,
    colorClass: 'yt-status-color-partial',
    label: 'Partial success',
    render: renderPartialSuccessIcon
  }, {
    re: /^-status-pending-$/i,
    colorClass: 'yt-status-color-neutral',
    label: 'Pending',
    render: renderPendingIcon
  }, {
    re: /^-status-running-$/i,
    colorClass: 'yt-status-color-neutral',
    label: 'Running',
    render: renderRunningIcon
  }, {
    re: /^-status-skipped-$/i,
    colorClass: 'yt-status-color-neutral',
    label: 'Skipped',
    render: renderSkippedIcon
  }];
  const renderStatusBadge = def => <span className={['yt-status-icon', def.colorClass].join(' ')} role="img" aria-label={def.label} title={def.label}>
      {def.render()}
    </span>;
  const tryParseKV = trimmed => {
    const m = KV_RE.exec(trimmed);
    return m ? {
      key: m[1],
      value: m[2].trim()
    } : null;
  };
  const registerKey = (key, seenKeys, orderedKeys) => {
    if (!seenKeys.has(key)) {
      orderedKeys.push(key);
      seenKeys.add(key);
    }
  };
  const flushEntry = (currentEntry, entries) => {
    if (Object.keys(currentEntry).length > 0) entries.push(currentEntry);
  };
  const parseDashPrefixed = (lines, entries, orderedKeys, seenKeys) => {
    let currentEntry = {};
    let inEntry = false;
    for (const line of lines) {
      const trimmed = line.trim();
      if (trimmed.startsWith('- ')) {
        if (inEntry) entries.push(currentEntry);
        currentEntry = {};
        inEntry = true;
        const kv = tryParseKV(trimmed.substring(2).trim());
        if (kv) {
          registerKey(kv.key, seenKeys, orderedKeys);
          currentEntry[kv.key] = kv.value;
        }
      } else if (inEntry && trimmed !== '') {
        const kv = tryParseKV(trimmed);
        if (kv) {
          registerKey(kv.key, seenKeys, orderedKeys);
          currentEntry[kv.key] = kv.value;
        }
      }
    }
    flushEntry(currentEntry, entries);
  };
  const parseBlankSeparated = (lines, entries, orderedKeys, seenKeys) => {
    let currentEntry = {};
    let inEntry = false;
    for (const line of lines) {
      const trimmed = line.trim();
      if (trimmed === '') {
        if (inEntry) {
          flushEntry(currentEntry, entries);
          currentEntry = {};
          inEntry = false;
        }
        continue;
      }
      const kv = tryParseKV(trimmed);
      if (!kv) continue;
      const isNewEntry = !line.startsWith(' ') && !line.startsWith('\t');
      if (isNewEntry && inEntry && Object.keys(currentEntry).length > 0) {
        entries.push(currentEntry);
        currentEntry = {};
      }
      registerKey(kv.key, seenKeys, orderedKeys);
      currentEntry[kv.key] = kv.value;
      inEntry = true;
    }
    flushEntry(currentEntry, entries);
  };
  const normalizeEntries = (entries, orderedKeys) => entries.map(entry => {
    const filled = {};
    for (const key of orderedKeys) filled[key] = entry[key] || '';
    return filled;
  });
  const parseYamlTableContent = contentStr => {
    if (!contentStr) return [];
    const entries = [];
    const orderedKeys = [];
    const seenKeys = new Set();
    const lines = contentStr.split('\n');
    if (lines.some(line => line.trim().startsWith('- '))) {
      parseDashPrefixed(lines, entries, orderedKeys, seenKeys);
    } else {
      parseBlankSeparated(lines, entries, orderedKeys, seenKeys);
    }
    return normalizeEntries(entries, orderedKeys);
  };
  const processText = text => {
    if (!text) return text;
    const parts = [];
    let keyIndex = 0;
    let lastIndex = 0;
    let match;
    while ((match = INLINE_MD_RE.exec(text)) !== null) {
      if (match.index > lastIndex) parts.push(text.slice(lastIndex, match.index));
      if (match[1]) {
        parts.push(<a key={keyIndex++} href={match[3]}>{match[2]}</a>);
      } else if (match[4]) {
        parts.push(<code key={keyIndex++}>{match[5]}</code>);
      } else if (match[6]) {
        parts.push(<strong key={keyIndex++}>{match[7]}</strong>);
      } else if (match[8]) {
        parts.push(<em key={keyIndex++}>{match[9]}</em>);
      }
      lastIndex = match.index + match[0].length;
    }
    if (lastIndex < text.length) parts.push(text.slice(lastIndex));
    if (parts.length === 0) return text;
    const keyRef = {
      current: keyIndex
    };
    return expandHtmlTags(parts, keyRef);
  };
  const processBadges = text => {
    if (!text || typeof text !== 'string') return text;
    if (YES_RE.test(text)) return <span className="yt-badge-yes" role="img" aria-label="Supported" title="Supported">✓</span>;
    if (NO_RE.test(text)) return <span className="yt-badge-no" role="img" aria-label="Not supported" title="Not supported">✗</span>;
    if (LIMITED_RE.test(text)) return <span className="yt-badge-limited" role="img" aria-label="Partially supported" title="Partially supported">◐</span>;
    if (NA_RE.test(text) || NA2_RE.test(text)) return <span className="yt-sr-only" title="Not applicable">Not applicable</span>;
    const statusBadge = STATUS_ICON_DEFS.find(def => def.re.test(text));
    if (statusBadge) return renderStatusBadge(statusBadge);
    return processText(text);
  };
  const cellClassName = text => {
    if (!text || typeof text !== 'string') return undefined;
    if (NA_RE.test(text)) return 'yt-cell-na';
    if (NA2_RE.test(text)) return 'yt-cell-na2';
    return undefined;
  };
  const expandSimpleTags = (str, keyRef) => {
    const result = [];
    let last = 0;
    SIMPLE_TAG_RE.lastIndex = 0;
    let m;
    while ((m = SIMPLE_TAG_RE.exec(str)) !== null) {
      if (m.index > last) result.push(str.slice(last, m.index));
      if (m[1]) {
        result.push(<br key={keyRef.current++} />);
      } else if (m[2]) {
        result.push(<br key={keyRef.current++} />, <br key={keyRef.current++} />);
      } else if (m[3]) {
        result.push(<span key={keyRef.current++} className="yt-badge-note" style={{
          fontWeight: 600
        }}>Note: </span>);
      } else if (m[4]) {
        result.push(<span key={keyRef.current++} className="yt-badge-warning" style={{
          fontWeight: 600
        }}>Warning: </span>);
      }
      last = m.index + m[0].length;
    }
    if (last < str.length) result.push(str.slice(last));
    return result;
  };
  const expandHtmlTags = (chunks, keyRef) => {
    const out = [];
    for (const chunk of chunks) {
      if (typeof chunk === 'string') {
        out.push(...expandSimpleTags(chunk, keyRef));
      } else {
        out.push(chunk);
      }
    }
    return out;
  };
  const extractText = node => {
    if (node === null || node === undefined) return '';
    if (typeof node === 'string') return node;
    if (typeof node === 'number') return String(node);
    if (typeof node === 'boolean') return '';
    if (Array.isArray(node)) return node.map(extractText).join('');
    if (node && typeof node === 'object' && node.type) {
      const props = node.props || ({});
      if (typeof props.children === 'string') return props.children;
      if (props.children) return extractText(props.children);
      return '';
    }
    return String(node || '');
  };
  const [mounted, setMounted] = useState(false);
  const scrollWrapRef = useRef(null);
  const [isScrollable, setIsScrollable] = useState(false);
  useEffect(() => {
    setMounted(true);
  }, []);
  const data = useMemo(() => {
    if (propData) return propData;
    if (content && typeof content === 'string') return parseYamlTableContent(content);
    if (!children) return [];
    if (typeof children === 'string') return parseYamlTableContent(children);
    const childrenArray = Array.isArray(children) ? children : [children];
    return parseYamlTableContent(childrenArray.map(extractText).join('').trim());
  }, [children, propData, content]);
  const columns = useMemo(() => {
    if (!data || data.length === 0) return [];
    const firstRow = data[0];
    if (!firstRow || typeof firstRow !== 'object') return [];
    return Object.keys(firstRow);
  }, [data]);
  useEffect(() => {
    const wrap = scrollWrapRef.current;
    if (!wrap) return undefined;
    const updateScrollable = () => {
      setIsScrollable(wrap.scrollWidth > wrap.clientWidth);
    };
    updateScrollable();
    const observer = new ResizeObserver(updateScrollable);
    observer.observe(wrap);
    return () => observer.disconnect();
  }, [mounted, data]);
  if (!mounted) return null;
  if (!data || data.length === 0) return null;
  const rowKey = row => columns.map(c => row[c] || '').join('|');
  return <div ref={scrollWrapRef} style={{
    overflowX: 'auto',
    margin: '1.75rem 0'
  }} role={isScrollable ? 'region' : undefined} aria-label={isScrollable ? 'Scrollable table' : undefined} tabIndex={isScrollable ? 0 : undefined}>
      <table style={{
    display: 'table',
    width: '100%',
    minWidth: '100%',
    margin: 0
  }}>
        <thead>
          <tr>
            {columns.map(col => <th key={col}>{col.replaceAll('_', ' ')}</th>)}
          </tr>
        </thead>
        <tbody>
          {data.map(row => <tr key={rowKey(row)}>
              {columns.map(col => <td key={col} className={cellClassName(row[col])}>{processBadges(row[col])}</td>)}
            </tr>)}
        </tbody>
      </table>
    </div>;
};

Endor Labs provides the following action policy templates that you can use to quickly create action policies.
Each policy template provides parameters to help you customize the conditions under which a policy action takes place.

<Note>
  All action policy templates automatically only match new findings for PR scans, assuming that there is a baseline that the scan results can be compared to. If the finding already exists in the baseline, then it is not considered to be a match. See [PR baseline](/developers-api/cli/commands/scan#pull-request-ci-flags) and [PR comments](/scan/pr-scans/pr-comments#enable-pr-comments) to learn more.
</Note>

The following template categories are available:

* [Container](#container)
* [GitHub Actions](#github-actions)
* [Malware](#malware)
* [SAST](#sast)
* [SCA](#sca)
* [Secrets](#secrets)
* [Security Review](#security-review)
* [Vulnerabilities](#vulnerabilities)

## Container

Use these templates to define actions for findings related to container images, including vulnerabilities in base images, installed packages, and container configurations.

### Containers

Matches container findings for vulnerabilities that meet specific parameters.

The following table describes the parameters.

<YamlTable>
  {`


    - Parameter: Vulnerability ID
    Description: Full vulnerability identifier. For example, CVE-2024-3727 or GHSA-qh2h-chj9-jffq (case insensitive).
    - Parameter: Severity
    Description: Only match findings with this severity.
    - Parameter: Fix Availability
    Description: Select **Fix Available** to only match findings if a patch is available to fix the issue in the dependency.
    - Parameter: Relationship
    Description: Select **Direct Dependency** to only match findings for direct dependencies, or **Transitive Dependency** to only match findings for transitive dependencies.
    - Parameter: EPSS Percentile Threshold
    Description: Only match findings with an EPSS percentile threshold equal to or higher than this threshold (0.00-100.00). The EPSS percentile threshold represents the percentile ranking among all vulnerabilities that attackers will exploit a vulnerability.
    - Parameter: EPSS Probability Threshold
    Description: Only match findings with an EPSS probability score equal to or higher than this threshold (0.00-1.00). The EPSS probability score represents the probability [0-1] of exploitation in the wild in the next 30 days following score publication.
    - Parameter: Exploited
    Description: Only match findings for CVEs listed in the Known Exploited Vulnerabilities (KEV) database.
    - Parameter: Ecosystem
    Description: Match finding ecosystem.
    - Parameter: Exclude if Dependency Name Contains
    Description: Allows you to define full or partial dependency names for which an action policy should exclude. For example, you want to exclude a specific dependency from this policy.
    - Parameter: Exclude if Package Name Contains
    Description: Allows you to define full or partial package names for which an action policy should exclude. This is the resource that the finding is raised against. For example, the package indirectly or directly includes an unmaintained dependency.
    - Parameter: Exclude findings for transitive dependencies via other projects
    Description: Exclude findings for transitive dependencies reachable only through other projects. This helps your team to not act when they do not have control of findings introduced by libraries your team developed.
    - Parameter: Branch Type
    Description: Only match findings for this branch type. Set to **Default** to match findings for the default branch. Set to **Ref** to match findings for reference (non-default) branches. Set to **Pull Request** to match findings for pull requests. The **Send Notification** action does not apply to pull requests, as notifications are only processed for monitored branches.


    `}
</YamlTable>

### Custom (Advanced)

Allows you to define a custom action policy based on the attributes of the finding.

The following table describes the parameters.

<YamlTable>
  {`


    - Parameter: Finding Name
    Description: Match full or partial finding name.
    - Parameter: Category
    Description: Match finding category.
    - Parameter: Type
    Description: Match finding type.
    - Parameter: Severity
    Description: Match finding severity.
    - Parameter: Fix Availability
    Description: Select **Fix Available** to only match findings if a patch is available to fix the issue in the dependency.
    - Parameter: Relationship
    Description: Select **Direct Dependency** to only match findings for direct dependencies, or **Transitive Dependency** to only match findings for transitive dependencies.
    - Parameter: Dependency Reachability
    Description: Select **Reachable Dependency** and **Potentially Reachable Dependency** to only match findings where the vulnerable dependency is reachable.
    - Parameter: Function Reachability
    Description: Select **Reachable Function** and **Potentially Reachable Function** to only match findings where the vulnerable function is reachable.
    - Parameter: Exclude Test
    Description: Select **Yes** to exclude test dependencies.
    - Parameter: Ecosystem
    Description: Match finding ecosystem.
    - Parameter: Custom Tag
    Description: Only match findings that have this custom tag (set by the policy that created the finding or using the \`--finding-tags\` CLI option). Note that these are different and separate from the system-defined finding tags.
    - Parameter: Include Path
    Description: Only match findings for dependencies or files that match this glob style file pattern. For example, \`src/golang/**\`.
    - Parameter: Exclude Path
    Description: Do not match findings for dependencies or files that match this glob style file pattern. For example, \`src/golang/**\`.
    - Parameter: Exclude if Dependency Name Contains
    Description: Allows you to define full or partial dependency names for which an action policy should exclude. For example, you want to exclude a specific dependency from this policy.
    - Parameter: Exclude if Package Name Contains
    Description: Allows you to define full or partial package names for which an action policy should exclude. This is the resource that the finding is raised against. For example, the package indirectly or directly includes an unmaintained dependency.
    - Parameter: Exclude findings for transitive dependencies via other projects
    Description: Exclude findings for transitive dependencies that can only be reached through other projects. This helps your team to not act when they do not have control of findings introduced by libraries your team developed.
    - Parameter: Include GitHub Action findings
    Description: Select **Yes** to include findings for GitHub action dependencies.
    - Parameter: Include Container findings
    Description: Select **Yes** to include findings for container dependencies.
    - Parameter: Branch Type
    Description: Only match findings for this branch type. Set to **Default** to match findings for the default branch. Set to **Ref** to match findings for reference (non-default) branches. Set to **Pull Request** to match findings for pull requests. Note that the **Send Notification** action does not apply to pull requests, as notifications are only processed for monitored branches.
    - Parameter: Code Owner
    Description: Only match findings with this code owner. For example, \`@octocat\` or \`@octocat-team\`. Case-insensitive exact matches only, no partial or approximate (fuzzy) matches. If a finding does not have a code owner, it is not matched by the policy. Code owners are automatically assigned to findings based on the \`CodeOwners\` object for the project, which is generated from the CODEOWNERS file in the default branch of the repository. For projects without a CODEOWNERS file, the \`CodeOwners\` object can be managed through the API.


    `}
</YamlTable>

#### Finding categories

Findings are classified into one or more of the following categories:

<YamlTable>
  {`


    - Category: AI Models
    Description: AI model related findings. See [AI model policies](/secure-ai-coding/ai-model-discovery/ai-model-policies) for details.
    - Category: CI/CD
    Description: Umbrella category for CI/CD pipeline findings including GitHub action and CI/CD tool findings.
    - Category: Container
    Description: Container related findings. See [Container policies](/platform-administration/policies/finding-policies/container-policies) for details.
    - Category: GitHub Actions
    Description: GitHub Action dependency findings. See [GitHub Action policies](/platform-administration/policies/finding-policies/github-action-policies) for details.
    - Category: License Risk
    Description: License related findings. See [License policies](/platform-administration/policies/finding-policies/license-policies) and [Open-source policies](/platform-administration/policies/finding-policies/oss-policies) for details.
    - Category: Malware
    Description: Malware findings.
    - Category: Operational
    Description: Umbrella category for operational issues including license risks, low dependency scores, outdated dependencies, recently released dependencies, unpinned dependencies, unreachable dependencies, unmaintained dependencies, and CI/CD findings.
    - Category: RSPM
    Description: Repository security posture management (RSPM) related findings. See [RSPM policies](/platform-administration/policies/finding-policies/managing-scm-configuration) for details.
    - Category: SAST
    Description: Static Application Security Testing (SAST) related findings.
    - Category: SCA
    Description: Umbrella category for Software Composition Analysis (SCA) related findings for software packages and their dependencies. Does not include AI model, Container, or CI/CD findings.
    - Category: Secrets
    Description: Findings for exposed secrets such as passwords or access tokens. See [Secret policies](/platform-administration/policies/finding-policies/secret-policies) for details.
    - Category: Security
    Description: Umbrella category for security issues including vulnerabilities, malware, phantom dependency, missing source code, SAST, secrets, and typosquatting findings.
    - Category: Supply Chain
    Description: Umbrella category for supply chain issues including malware, typosquatting, license risk, and AI model findings.
    - Category: Vulnerability
    Description: Vulnerability findings.


    `}
</YamlTable>

#### Finding types

Findings are classified into the following types when the packages scanned include:

<YamlTable>
  {`


    - Type: Custom
    Description: Custom findings defined in custom policies.
    - Type: Dependency With Low Activity Score
    Description: Low Endor activity score.
    - Type: Dependency With Low Popularity Score
    Description: Low Endor popularity score.
    - Type: Dependency With Low Quality Score
    Description: Low Endor quality score.
    - Type: Dependency With Multiple Low Scores
    Description: More than one Low Endor Score.
    - Type: Dependency With Very Low Activity Scores
    Description: Very low Endor activity score.
    - Type: Dependency With Very Low Popularity Score
    Description: Very low Endor popularity score.
    - Type: Dependency With Very Low Quality Score
    Description: Very low Endor quality score.
    - Type: License Risk
    Description: Missing, unknown, restricted, or problematic licenses.
    - Type: Malware Dependency
    Description: Known malicious dependencies reported by Open Source Vulnerabilities (OSV).
    - Type: Malware OSS Review
    Description: Potentially suspicious code that needs review.
    - Type: Missing Source Code
    Description: Associated source code is not auditable.
    - Type: Outdated Dependency
    Description: Outdated code with older versions of the released dependencies.
    - Type: Recently Released Dependency
    Description: Dependencies with newer versions than the configured cooldown period.
    - Type: Typosquatted Dependency
    Description: Dependencies with intentionally similar names to popular packages.
    - Type: Unmaintained Dependency
    Description: Unmaintained dependencies introducing vulnerabilities.
    - Type: Unpinned Dependency
    Description: Variable version specifications of dependencies.
    - Type: Unused Dependency
    Description: Unused dependencies in the code.


    `}
</YamlTable>

## GitHub Actions

Use this template to match findings from GitHub Actions workflows, such as risky action usage or supply chain issues in your CI configuration.

Ensure the relevant [GitHub Action finding policies](/platform-administration/policies/finding-policies/github-action-policies) are enabled so Endor Labs raises these findings.

The following table describes the parameters.

<YamlTable>
  {`


    - Parameter: Finding Name
    Description: Only match findings with one of these finding names. Defaults to \`Unpinned direct dependency\`, \`Untrusted code checkout\`, and \`Imposter commit\`.
    - Parameter: Severity
    Description: Only match findings that have this severity level.
    - Parameter: Custom Tag
    Description: Only match findings that have this custom tag (set by the policy that created the finding or using the \`--finding-tags\` CLI option). These are different and separate from the system-defined finding tags.
    - Parameter: Branch Type
    Description: Only match findings for this branch type. Set to **Default** to match findings for the default branch. Set to **Ref** to match findings for reference (non-default) branches. Set to **Pull Request** to match findings for pull requests. Set to **Any** to match findings for all branch types. The **Send Notification** action does not apply to pull requests, as notifications are only processed for monitored branches.


    `}
</YamlTable>

## Malware

Allows you to define the action policy to apply when a malware finding is detected, depending on its status, relationship to root packages, and ecosystem.

The following table describes the parameters.

<YamlTable>
  {`


    - Parameter: Status
    Description: Select the status of malware finding such as **Malware** for confirmed malware, **Telemetry** if the package is not always malicious but may expose environment details, or **Unhealthy** if the package appears broken or non-functional.
    - Parameter: Exposure
    Description: Select **Definitely Affected** to match findings where the resolved dependency version matches a known malicious package version, or **Potentially Affected** to match findings where the dependency's version constraints could resolve to one. You can choose either option or both.
    - Parameter: Relationship
    Description: Select **Direct Dependency** to only match findings for direct dependencies, or **Transitive Dependency** to only match findings for transitive dependencies.
    - Parameter: Ecosystem
    Description: Match finding ecosystem.
    - Parameter: Exclude Test
    Description: Select **Yes** to exclude test dependencies from this policy.
    - Parameter: Exclude Approximate
    Description: Select **Yes** to exclude approximate dependencies from this policy.


    `}
</YamlTable>

## SAST

Allows you to define the action taken when a SAST finding is raised.

<YamlTable>
  {`


    - Parameter: Severity
    Description: Only match findings that have this severity level.
    - Parameter: Confidence
    Description: Only match findings for SAST rules with this confidence level.
    - Parameter: Language
    Description: Only match findings for this SAST result language.
    - Parameter: SAST Tag
    Description: Only match findings that have this SAST tag. For example, \`A01:2021\` or \`Cryptographic-Failures\`.
    - Parameter: AI Analysis Status
    Description: Only match findings classified by the AI SAST triage agent. Set to \`True Positive\` to match findings the agent confirmed as genuine, or \`False Positive\` to match findings the agent dismissed.
    - Parameter: AI SAST
    Description: Set to \`Yes\` to match only findings generated by the AI SAST detection agent.
    - Parameter: Custom Tag
    Description: Only match findings that have this custom tag (set by the policy that created the finding or using the \`--finding-tags\` CLI option). These are different and separate from the system-defined finding tags.
    - Parameter: CWE
    Description: Only match findings with this CWE. For example, \`CWE-123\` or \`CWE-456\` (case insensitive).
    - Parameter: File Scope
    Description: Only match findings with this file scope. For example, \`Normal\` or \`Test\`.
    - Parameter: Include Path
    Description: Only match findings for files that match this glob style file pattern. For example, \`src/golang/**\`.
    - Parameter: Exclude Path
    Description: Do not match findings for files that match this glob style file pattern. For example, \`src/golang/**\`.
    - Parameter: Branch Type
    Description: Only match findings for this branch type. Set to **Default** to match findings for the default branch. Set to **Ref** to match findings for reference (non-default) branches. Set to **Pull Request** to match findings for pull requests. The **Send Notification** action does not apply to pull requests, as notifications are only processed for monitored branches.
    - Parameter: Code Owner
    Description: Only match findings with this code owner. For example, \`@octocat\` or \`@octocat-team\`. Case-insensitive exact matches only, no partial or approximate (fuzzy) matches. If a finding does not have a code owner, it is not matched by the policy. Code owners are automatically assigned to findings based on the \`CodeOwners\` object for the project, which is generated from the CODEOWNERS file in the default branch of the repository. For projects without a CODEOWNERS file, the \`CodeOwners\` object can be managed through the API.


    `}
</YamlTable>

## SCA

Use these templates to define actions for Software Composition Analysis (SCA) findings, including vulnerabilities, outdated dependencies, unmaintained packages, license risks, and other issues in your open-source dependencies.

### Containers

Matches container findings for vulnerabilities that meet specific parameters.

The following table describes the parameters.

<YamlTable>
  {`


    - Parameter: Vulnerability ID
    Description: Full vulnerability identifier. For example, CVE-2024-3727 or GHSA-qh2h-chj9-jffq (case insensitive).
    - Parameter: Severity
    Description: Only match findings with this severity.
    - Parameter: Fix Availability
    Description: Select **Fix Available** to only match findings if a patch is available to fix the issue in the dependency.
    - Parameter: Relationship
    Description: Select **Direct Dependency** to only match findings for direct dependencies, or **Transitive Dependency** to only match findings for transitive dependencies.
    - Parameter: EPSS Percentile Threshold
    Description: Only match findings with an EPSS percentile threshold equal to or higher than this threshold (0.00-100.00). The EPSS percentile threshold represents the percentile ranking among all vulnerabilities that attackers will exploit a vulnerability.
    - Parameter: EPSS Probability Threshold
    Description: Only match findings with an EPSS probability score equal to or higher than this threshold (0.00-1.00). The EPSS probability score represents the probability [0-1] of exploitation in the wild in the next 30 days following score publication.
    - Parameter: Exploited
    Description: Only match findings for CVEs listed in the Known Exploited Vulnerabilities (KEV) database.
    - Parameter: Ecosystem
    Description: Match finding ecosystem.
    - Parameter: Exclude if Dependency Name Contains
    Description: Allows you to define full or partial dependency names for which an action policy should exclude. For example, you want to exclude a specific dependency from this policy.
    - Parameter: Exclude if Package Name Contains
    Description: Allows you to define full or partial package names for which an action policy should exclude. This is the resource that the finding is raised against. For example, the package indirectly or directly includes an unmaintained dependency.
    - Parameter: Exclude findings for transitive dependencies via other projects
    Description: Exclude findings for transitive dependencies reachable only through other projects. This helps your team to not act when they do not have control of findings introduced by libraries your team developed.
    - Parameter: Branch Type
    Description: Only match findings for this branch type. Set to **Default** to match findings for the default branch. Set to **Ref** to match findings for reference (non-default) branches. Set to **Pull Request** to match findings for pull requests. The **Send Notification** action does not apply to pull requests, as notifications are only processed for monitored branches.


    `}
</YamlTable>

### Custom (Advanced)

Allows you to define a custom action policy based on the attributes of the finding.

The following table describes the parameters.

<YamlTable>
  {`


    - Parameter: Finding Name
    Description: Match full or partial finding name.
    - Parameter: Category
    Description: Match finding category.
    - Parameter: Type
    Description: Match finding type.
    - Parameter: Severity
    Description: Match finding severity.
    - Parameter: Fix Availability
    Description: Select **Fix Available** to only match findings if a patch is available to fix the issue in the dependency.
    - Parameter: Relationship
    Description: Select **Direct Dependency** to only match findings for direct dependencies, or **Transitive Dependency** to only match findings for transitive dependencies.
    - Parameter: Dependency Reachability
    Description: Select **Reachable Dependency** and **Potentially Reachable Dependency** to only match findings where the vulnerable dependency is reachable.
    - Parameter: Function Reachability
    Description: Select **Reachable Function** and **Potentially Reachable Function** to only match findings where the vulnerable function is reachable.
    - Parameter: Exclude Test
    Description: Select **Yes** to exclude test dependencies.
    - Parameter: Ecosystem
    Description: Match finding ecosystem.
    - Parameter: Custom Tag
    Description: Only match findings that have this custom tag (set by the policy that created the finding or using the \`--finding-tags\` CLI option). Note that these are different and separate from the system-defined finding tags.
    - Parameter: Include Path
    Description: Only match findings for dependencies or files that match this glob style file pattern. For example, \`src/golang/**\`.
    - Parameter: Exclude Path
    Description: Do not match findings for dependencies or files that match this glob style file pattern. For example, \`src/golang/**\`.
    - Parameter: Exclude if Dependency Name Contains
    Description: Allows you to define full or partial dependency names for which an action policy should exclude. For example, you want to exclude a specific dependency from this policy.
    - Parameter: Exclude if Package Name Contains
    Description: Allows you to define full or partial package names for which an action policy should exclude. This is the resource that the finding is raised against. For example, the package indirectly or directly includes an unmaintained dependency.
    - Parameter: Exclude findings for transitive dependencies via other projects
    Description: Exclude findings for transitive dependencies that can only be reached through other projects. This helps your team to not act when they do not have control of findings introduced by libraries your team developed.
    - Parameter: Include GitHub Action findings
    Description: Select **Yes** to include findings for GitHub action dependencies.
    - Parameter: Include Container findings
    Description: Select **Yes** to include findings for container dependencies.
    - Parameter: Branch Type
    Description: Only match findings for this branch type. Set to **Default** to match findings for the default branch. Set to **Ref** to match findings for reference (non-default) branches. Set to **Pull Request** to match findings for pull requests. Note that the **Send Notification** action does not apply to pull requests, as notifications are only processed for monitored branches.
    - Parameter: Code Owner
    Description: Only match findings with this code owner. For example, \`@octocat\` or \`@octocat-team\`. Case-insensitive exact matches only, no partial or approximate (fuzzy) matches. If a finding does not have a code owner, it is not matched by the policy. Code owners are automatically assigned to findings based on the \`CodeOwners\` object for the project, which is generated from the CODEOWNERS file in the default branch of the repository. For projects without a CODEOWNERS file, the \`CodeOwners\` object can be managed through the API.


    `}
</YamlTable>

### Malware

Allows you to define the action policy to apply when a malware finding is detected, depending on its status, relationship to root packages, and ecosystem.

The following table describes the parameters.

<YamlTable>
  {`


    - Parameter: Status
    Description: Select the status of malware finding such as **Malware** for confirmed malware, **Telemetry** if the package is not always malicious but may expose environment details, or **Unhealthy** if the package appears broken or non-functional.
    - Parameter: Exposure
    Description: Select **Definitely Affected** to match findings where the resolved dependency version matches a known malicious package version, or **Potentially Affected** to match findings where the dependency's version constraints could resolve to one. You can choose either option or both.
    - Parameter: Relationship
    Description: Select **Direct Dependency** to only match findings for direct dependencies, or **Transitive Dependency** to only match findings for transitive dependencies.
    - Parameter: Ecosystem
    Description: Match finding ecosystem.
    - Parameter: Exclude Test
    Description: Select **Yes** to exclude test dependencies from this policy.
    - Parameter: Exclude Approximate
    Description: Select **Yes** to exclude approximate dependencies from this policy.


    `}
</YamlTable>

### Outdated Releases

Matches findings based on older versions of software or dependencies and are not actively updated. The following parameters are supported:

<YamlTable>
  {`


    - Parameter: Relationship
    Description: Select **Direct Dependency** to only match findings for direct dependencies, or **Transitive Dependency** to only match findings for transitive dependencies.
    - Parameter: Dependency Reachability
    Description: Select **Reachable Dependency** and **Potentially Reachable Dependency** to only match findings where the vulnerable dependency is reachable.
    - Parameter: Exclude Test
    Description: Exclude test dependencies from this policy.
    - Parameter: Ecosystem
    Description: Match finding ecosystem.
    - Parameter: Exclude if Dependency Name Contains
    Description: Allows you to define full or partial dependency names for which an action policy should exclude. For example, you want to exclude a specific dependency from this policy.
    - Parameter: Exclude if Package Name Contains
    Description: Allows you to define full or partial package names for which an action policy should exclude. This is the resource that the finding is raised against. For example, the package indirectly or directly includes an unmaintained dependency.
    - Parameter: Exclude findings for transitive dependencies via other projects
    Description: Exclude findings for transitive dependencies that can only be reached through other projects. This helps your team to not act when they do not have control of findings introduced by libraries your team developed.


    `}
</YamlTable>

### Recently Released Dependencies (cooldown)

Matches findings for recently released dependencies. Supported configuration parameters for this action policy template are:

<YamlTable>
  {`


    - Parameter: Ecosystem
    Description: Match finding ecosystem.
    - Parameter: Exclude Test
    Description: Exclude test dependencies from this policy.
    - Parameter: Exclude if Dependency Name Contains
    Description: Allows you to define full or partial dependency names for which an action policy should exclude. For example, you want to exclude a specific dependency from this policy.
    - Parameter: Exclude if Package Name Contains
    Description: Allows you to define full or partial package names for which an action policy should exclude. This is the resource that the finding is raised against. For example, the package indirectly or directly includes an unmaintained dependency.
    - Parameter: Exclude findings for transitive dependencies via other projects
    Description: Exclude findings for transitive dependencies that can only be reached through other projects. This helps your team to not act when they do not have control of findings introduced by libraries your team developed.
    - Parameter: Branch Type
    Description: Only match findings for this branch type. Set to **Default** to match findings for the default branch. Set to **Ref** to match findings for reference (non-default) branches. Set to **Pull Request** to match findings for pull requests. The **Send Notification** action does not apply to pull requests, as notifications are only processed for monitored branches.


    `}
</YamlTable>

### Unmaintained Dependencies

Matches findings based on dependencies that are no longer maintained or may have reached end-of-life. The following parameters are supported:

<YamlTable>
  {`


    - Parameter: Relationship
    Description: Select **Direct Dependency** to only match findings for direct dependencies, or **Transitive Dependency** to only match findings for transitive dependencies.
    - Parameter: Dependency Reachability
    Description: Select **Reachable Dependency** and **Potentially Reachable Dependency** to only match findings where the vulnerable dependency is reachable.
    - Parameter: Exclude Test
    Description: Exclude test dependencies from this policy.
    - Parameter: Ecosystem
    Description: Match finding ecosystem.
    - Parameter: Exclude if Dependency Name Contains
    Description: Allows you to define full or partial dependency names for which an action policy should exclude. For example, you want to exclude a specific dependency from this policy.
    - Parameter: Exclude if Package Name Contains
    Description: Allows you to define full or partial package names for which an action policy should exclude. This is the resource that the finding is raised against. For example, the package indirectly or directly includes an unmaintained dependency.
    - Parameter: Exclude findings for transitive dependencies via other projects
    Description: Exclude findings for transitive dependencies that can only be reached through other projects. This helps your team to not act when they do not have control of findings introduced by libraries your team developed.


    `}
</YamlTable>

### Unpinned Direct Dependencies

Matches findings based on direct dependencies that do not have a version or a range of versions specified. Supported configuration parameters for this action policy template are:

<YamlTable>
  {`


    - Parameter: Exclude Test
    Description: Exclude test dependencies from this policy.
    - Parameter: Ecosystem
    Description: Match finding ecosystem.
    - Parameter: Exclude if Dependency Name Contains
    Description: Allows you to define full or partial dependency names for which an action policy should exclude. For example, you want to exclude a specific dependency from this policy.
    - Parameter: Exclude if Package Name Contains
    Description: Allows you to define full or partial package names for which an action policy should exclude. This is the resource that the finding is raised against. For example, the package indirectly or directly includes an unmaintained dependency.
    - Parameter: Exclude findings for transitive dependencies via other projects
    Description: Exclude findings for transitive dependencies that can only be reached through other projects. This helps your team to not act when they do not have control of findings introduced by libraries your team developed.


    `}
</YamlTable>

### Unreachable Direct Dependencies

Matches findings based on dependencies that are not directly used or called within a project. Supported configuration parameters for this action policy template are:

<YamlTable>
  {`


    - Parameter: Exclude Test
    Description: Exclude test dependencies from this policy.
    - Parameter: Ecosystem
    Description: Match finding ecosystem.
    - Parameter: Exclude if Dependency Name Contains
    Description: Allows you to define full or partial dependency names for which an action policy should exclude. For example, you want to exclude a specific dependency from this policy.
    - Parameter: Exclude if Package Name Contains
    Description: Allows you to define full or partial package names for which an action policy should exclude. This is the resource that the finding is raised against. For example, the package indirectly or directly includes an unmaintained dependency.
    - Parameter: Exclude findings for transitive dependencies via other projects
    Description: Exclude findings for transitive dependencies that can only be reached through other projects. This helps your team to not act when they do not have control of findings introduced by libraries your team developed.


    `}
</YamlTable>

### Vulnerabilities

Matches findings that are vulnerabilities that meet specific parameters.

The following table describes the parameters.

<YamlTable>
  {`


    - Parameter: Vulnerability ID
    Description: Full vulnerability identifier. For example, \`CVE-2024-3727\` or \`GHSA-qh2h-chj9-jffq\` (case insensitive).
    - Parameter: Severity
    Description: Only match findings with this severity.
    - Parameter: Fix Availability
    Description: Select **Fix Available** to only match findings if a patch is available to fix the issue in the dependency.
    - Parameter: Relationship
    Description: Select **Direct Dependency** to only match findings for direct dependencies, or **Transitive Dependency** to only match findings for transitive dependencies.
    - Parameter: Dependency Reachability
    Description: Select **Reachable Dependency** and **Potentially Reachable Dependency** to only match findings where the vulnerable dependency is reachable.
    - Parameter: Function Reachability
    Description: Select **Reachable Function** and **Potentially Reachable Function** to only match findings where the vulnerable function is reachable.
    - Parameter: Exclude Test
    Description: Select **Yes** to exclude test dependencies from this policy.
    - Parameter: EPSS Percentile Threshold
    Description: Only match findings with an EPSS percentile threshold equal to or higher than this threshold (0.00–100.00). The EPSS percentile threshold represents the percentile ranking among all vulnerabilities that a vulnerability will be exploited.
    - Parameter: EPSS Probability Threshold
    Description: Only match findings with an EPSS probability score equal to or higher than this threshold (0.00–1.00). The EPSS probability score represents the probability [0–1] of exploitation in the wild in the next 30 days following score publication.
    - Parameter: Exploited
    Description: Only match findings for CVEs that are listed in the Known Exploited Vulnerabilities (KEV) database.
    - Parameter: Ecosystem
    Description: Match finding ecosystem.
    - Parameter: Exclude if Dependency Name Contains
    Description: Allows you to define full or partial dependency names for which an action policy should exclude. For example, you want to exclude a specific dependency from this policy.
    - Parameter: Exclude if Package Name Contains
    Description: Allows you to define full or partial package names for which an action policy should exclude. This is the resource that the finding is raised against. For example, the package indirectly or directly includes an unmaintained dependency.
    - Parameter: Exclude findings for transitive dependencies via other projects
    Description: Exclude findings for transitive dependencies that can only be reached through other projects. This helps your team to not act when they do not have control of findings introduced by libraries your team developed.
    - Parameter: Include GitHub Action findings
    Description: Select **Yes** to include findings for GitHub action dependencies.
    - Parameter: Include Container findings
    Description: Select **Yes** to include findings for container dependencies.
    - Parameter: Branch Type
    Description: Only match findings for this branch type. Set to **Default** to match findings for the default branch. Set to **Ref** to match findings for reference (non-default) branches. Set to **Pull Request** to match findings for pull requests. Note that the **Send Notification** action does not apply to pull requests, as notifications are only processed for monitored branches.
    - Parameter: Code Owner
    Description: Only match findings with this code owner. For example, \`@octocat\` or \`@octocat-team\`. Case-insensitive exact matches only, no partial or approximate (fuzzy) matches. If a finding does not have a code owner, it is not matched by the policy. Code owners are automatically assigned to findings based on the \`CodeOwners\` object for the project, which is generated from the CODEOWNERS file in the default branch of the repository. For projects without a CODEOWNERS file, the \`CodeOwners\` object can be managed through the API.


    `}
</YamlTable>

## Secrets

Allows you to define the action taken when a leaked secret is detected based on the validation status of the secret.

<YamlTable>
  {`


    - Parameter: Validation Status
    Description: Select secret validation status: **Valid**, **Invalid**, or **Unable to Validate**.
    - Parameter: Custom Tag
    Description: Only match findings that have this custom tag (set by the policy that created the finding or using the \`--finding-tags\` CLI option). These are different and separate from the system-defined finding tags.
    - Parameter: Include Path
    Description: Only match findings for files that match this glob style file pattern. For example, \`src/golang/**\`.
    - Parameter: Exclude Path
    Description: Do not match findings for files that match this glob style file pattern. For example, \`src/golang/**\`.
    - Parameter: Code Owner
    Description: Only match findings with this code owner. For example, \`@octocat\` or \`@octocat-team\`. Case-insensitive exact matches only, no partial or approximate (fuzzy) matches. If a finding does not have a code owner, it is not matched by the policy. Code owners are automatically assigned to findings based on the \`CodeOwners\` object for the project, which is generated from the CODEOWNERS file in the default branch of the repository. For projects without a CODEOWNERS file, the \`CodeOwners\` object can be managed through the API.


    `}
</YamlTable>

## Security Review

Use these templates to define actions for security review findings that require manual assessment or additional analysis before taking action.

Match security review findings. The following parameters are supported:

<YamlTable>
  {`


    - Parameter: Severity
    Description: Only match findings with this severity.
    - Parameter: Branch Type
    Description: Only match findings for this branch type. Set to **Default** to match findings for the default branch. Set to **Ref** to match findings for reference (non-default) branches. Set to **Pull Request** to match findings for pull requests. The **Send Notification** action does not apply to pull requests, as notifications are only processed for monitored branches.


    `}
</YamlTable>

## Vulnerabilities

Use these templates to define actions for vulnerability findings, including CVEs, security advisories, and known exploits in your dependencies based on severity, exploitability, and fix availability.

### Containers

Matches container findings for vulnerabilities that meet specific parameters.

The following table describes the parameters.

<YamlTable>
  {`


    - Parameter: Vulnerability ID
    Description: Full vulnerability identifier. For example, CVE-2024-3727 or GHSA-qh2h-chj9-jffq (case insensitive).
    - Parameter: Severity
    Description: Only match findings with this severity.
    - Parameter: Fix Availability
    Description: Select **Fix Available** to only match findings if a patch is available to fix the issue in the dependency.
    - Parameter: Relationship
    Description: Select **Direct Dependency** to only match findings for direct dependencies, or **Transitive Dependency** to only match findings for transitive dependencies.
    - Parameter: EPSS Percentile Threshold
    Description: Only match findings with an EPSS percentile threshold equal to or higher than this threshold (0.00-100.00). The EPSS percentile threshold represents the percentile ranking among all vulnerabilities that attackers will exploit a vulnerability.
    - Parameter: EPSS Probability Threshold
    Description: Only match findings with an EPSS probability score equal to or higher than this threshold (0.00-1.00). The EPSS probability score represents the probability [0-1] of exploitation in the wild in the next 30 days following score publication.
    - Parameter: Exploited
    Description: Only match findings for CVEs listed in the Known Exploited Vulnerabilities (KEV) database.
    - Parameter: Ecosystem
    Description: Match finding ecosystem.
    - Parameter: Exclude if Dependency Name Contains
    Description: Allows you to define full or partial dependency names for which an action policy should exclude. For example, you want to exclude a specific dependency from this policy.
    - Parameter: Exclude if Package Name Contains
    Description: Allows you to define full or partial package names for which an action policy should exclude. This is the resource that the finding is raised against. For example, the package indirectly or directly includes an unmaintained dependency.
    - Parameter: Exclude findings for transitive dependencies via other projects
    Description: Exclude findings for transitive dependencies reachable only through other projects. This helps your team to not act when they do not have control of findings introduced by libraries your team developed.
    - Parameter: Branch Type
    Description: Only match findings for this branch type. Set to **Default** to match findings for the default branch. Set to **Ref** to match findings for reference (non-default) branches. Set to **Pull Request** to match findings for pull requests. The **Send Notification** action does not apply to pull requests, as notifications are only processed for monitored branches.


    `}
</YamlTable>

### Custom (Advanced)

Allows you to define a custom action policy based on the attributes of the finding.

The following table describes the parameters.

<YamlTable>
  {`


    - Parameter: Finding Name
    Description: Match full or partial finding name.
    - Parameter: Category
    Description: Match finding category.
    - Parameter: Type
    Description: Match finding type.
    - Parameter: Severity
    Description: Match finding severity.
    - Parameter: Fix Availability
    Description: Select **Fix Available** to only match findings if a patch is available to fix the issue in the dependency.
    - Parameter: Relationship
    Description: Select **Direct Dependency** to only match findings for direct dependencies, or **Transitive Dependency** to only match findings for transitive dependencies.
    - Parameter: Dependency Reachability
    Description: Select **Reachable Dependency** and **Potentially Reachable Dependency** to only match findings where the vulnerable dependency is reachable.
    - Parameter: Function Reachability
    Description: Select **Reachable Function** and **Potentially Reachable Function** to only match findings where the vulnerable function is reachable.
    - Parameter: Exclude Test
    Description: Select **Yes** to exclude test dependencies.
    - Parameter: Ecosystem
    Description: Match finding ecosystem.
    - Parameter: Custom Tag
    Description: Only match findings that have this custom tag (set by the policy that created the finding or using the \`--finding-tags\` CLI option). Note that these are different and separate from the system-defined finding tags.
    - Parameter: Include Path
    Description: Only match findings for dependencies or files that match this glob style file pattern. For example, \`src/golang/**\`.
    - Parameter: Exclude Path
    Description: Do not match findings for dependencies or files that match this glob style file pattern. For example, \`src/golang/**\`.
    - Parameter: Exclude if Dependency Name Contains
    Description: Allows you to define full or partial dependency names for which an action policy should exclude. For example, you want to exclude a specific dependency from this policy.
    - Parameter: Exclude if Package Name Contains
    Description: Allows you to define full or partial package names for which an action policy should exclude. This is the resource that the finding is raised against. For example, the package indirectly or directly includes an unmaintained dependency.
    - Parameter: Exclude findings for transitive dependencies via other projects
    Description: Exclude findings for transitive dependencies that can only be reached through other projects. This helps your team to not act when they do not have control of findings introduced by libraries your team developed.
    - Parameter: Include GitHub Action findings
    Description: Select **Yes** to include findings for GitHub action dependencies.
    - Parameter: Include Container findings
    Description: Select **Yes** to include findings for container dependencies.
    - Parameter: Branch Type
    Description: Only match findings for this branch type. Set to **Default** to match findings for the default branch. Set to **Ref** to match findings for reference (non-default) branches. Set to **Pull Request** to match findings for pull requests. Note that the **Send Notification** action does not apply to pull requests, as notifications are only processed for monitored branches.
    - Parameter: Code Owner
    Description: Only match findings with this code owner. For example, \`@octocat\` or \`@octocat-team\`. Case-insensitive exact matches only, no partial or approximate (fuzzy) matches. If a finding does not have a code owner, it is not matched by the policy. Code owners are automatically assigned to findings based on the \`CodeOwners\` object for the project, which is generated from the CODEOWNERS file in the default branch of the repository. For projects without a CODEOWNERS file, the \`CodeOwners\` object can be managed through the API.


    `}
</YamlTable>

### Vulnerabilities

Matches findings that are vulnerabilities that meet specific parameters.

The following table describes the parameters.

<YamlTable>
  {`


    - Parameter: Vulnerability ID
    Description: Full vulnerability identifier. For example, \`CVE-2024-3727\` or \`GHSA-qh2h-chj9-jffq\` (case insensitive).
    - Parameter: Severity
    Description: Only match findings with this severity.
    - Parameter: Fix Availability
    Description: Select **Fix Available** to only match findings if a patch is available to fix the issue in the dependency.
    - Parameter: Relationship
    Description: Select **Direct Dependency** to only match findings for direct dependencies, or **Transitive Dependency** to only match findings for transitive dependencies.
    - Parameter: Dependency Reachability
    Description: Select **Reachable Dependency** and **Potentially Reachable Dependency** to only match findings where the vulnerable dependency is reachable.
    - Parameter: Function Reachability
    Description: Select **Reachable Function** and **Potentially Reachable Function** to only match findings where the vulnerable function is reachable.
    - Parameter: Exclude Test
    Description: Select **Yes** to exclude test dependencies from this policy.
    - Parameter: EPSS Percentile Threshold
    Description: Only match findings with an EPSS percentile threshold equal to or higher than this threshold (0.00–100.00). The EPSS percentile threshold represents the percentile ranking among all vulnerabilities that a vulnerability will be exploited.
    - Parameter: EPSS Probability Threshold
    Description: Only match findings with an EPSS probability score equal to or higher than this threshold (0.00–1.00). The EPSS probability score represents the probability [0–1] of exploitation in the wild in the next 30 days following score publication.
    - Parameter: Exploited
    Description: Only match findings for CVEs that are listed in the Known Exploited Vulnerabilities (KEV) database.
    - Parameter: Ecosystem
    Description: Match finding ecosystem.
    - Parameter: Exclude if Dependency Name Contains
    Description: Allows you to define full or partial dependency names for which an action policy should exclude. For example, you want to exclude a specific dependency from this policy.
    - Parameter: Exclude if Package Name Contains
    Description: Allows you to define full or partial package names for which an action policy should exclude. This is the resource that the finding is raised against. For example, the package indirectly or directly includes an unmaintained dependency.
    - Parameter: Exclude findings for transitive dependencies via other projects
    Description: Exclude findings for transitive dependencies that can only be reached through other projects. This helps your team to not act when they do not have control of findings introduced by libraries your team developed.
    - Parameter: Include GitHub Action findings
    Description: Select **Yes** to include findings for GitHub action dependencies.
    - Parameter: Include Container findings
    Description: Select **Yes** to include findings for container dependencies.
    - Parameter: Branch Type
    Description: Only match findings for this branch type. Set to **Default** to match findings for the default branch. Set to **Ref** to match findings for reference (non-default) branches. Set to **Pull Request** to match findings for pull requests. Note that the **Send Notification** action does not apply to pull requests, as notifications are only processed for monitored branches.
    - Parameter: Code Owner
    Description: Only match findings with this code owner. For example, \`@octocat\` or \`@octocat-team\`. Case-insensitive exact matches only, no partial or approximate (fuzzy) matches. If a finding does not have a code owner, it is not matched by the policy. Code owners are automatically assigned to findings based on the \`CodeOwners\` object for the project, which is generated from the CODEOWNERS file in the default branch of the repository. For projects without a CODEOWNERS file, the \`CodeOwners\` object can be managed through the API.


    `}
</YamlTable>