> ## Documentation Index
> Fetch the complete documentation index at: https://semgrep-ee9d73d8-abhijna-tec-647-weekly-release-notes.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Create and manage Unified Policies

This document explains how to migrate existing policies to [Unified Policies](/semgrep-appsec-platform/unified-policies/overview), create new policies, and manage existing ones.

## Migrate existing policies

To migrate your existing legacy policies and use Unified Policies:

<Steps>
  <Step>
    Sign in to [<Icon icon="external-link" iconType="solid" /> Semgrep AppSec Platform](https://semgrep.dev/login).
  </Step>

  <Step>
    Go to **Rules & Policies > Policies**. You will see a banner that prompts you to begin the upgrade to Unified Policies. Click to launch the **Upgrade to Unified Policies** dialog, and follow the on-screen prompts to proceed.
  </Step>

  <Step>
    Review the policies that Semgrep has migrated for you. For each product where you have existing policies, select the **I have reviewed these migration details** checkbox to proceed.
  </Step>

  <Step>
    When you have completed the migration process, you are redirected to the new **Policies** page, where you can manage your detection and remediation policies.
  </Step>
</Steps>

<note>
  <strong>Note:</strong> Email notifications are not supported by Unified Policies. If you currently have an email integration set up, no additional emails will be sent after you migrate to Unified Policies.
</note>

## Create a remediation policy

<Steps>
  <Step>
    Sign in to Semgrep AppSec Platform.
  </Step>

  <Step>
    Go to **Rules & Policies > Remediation**.
  </Step>

  <Step>
    To create a policy that defines the automated responses to security findings:

    1. Click **+ Create automation**.

    2. Provide a **Policy name**. If **Auto** is enabled, this field auto-populates with a descriptive name based on the conditions and actions you define for the policy. Toggle to **Auto-off** to manually enter a name for the policy.

    3. Set the **Scope** of the policy by selecting all of the projects to which this policy applies. You can select all projects, select specific projects by name, or select specific projects by project tags.

    4. Define the **Conditions** that trigger the policy by clicking **+ Add condition** to expand a drop-down list of attributes that you can use. Select the attribute, then set the specific conditions.
       * For example, you can select **Severity**, then complete the conditional statement provided to read **When Severity is any of Critical, High**.
       * You can define as many conditions as necessary, and Semgrep treats them additively.

    5. Choose the **Actions** that occur if there are findings that trigger the policy by clicking **+ Add action**. You can choose multiple **Actions**, including:

           <CardGroup>
             <Card title="Block merge and comment on PR/MR" icon="code-branch" href="/category/pr-or-mr-comments" horizontal />

             <Card title="Comment on PR/MR" icon="message" href="/category/pr-or-mr-comments" horizontal />

             <Card title="Create a Jira ticket" icon="jira" href="/semgrep-appsec-platform/jira" horizontal />

             <Card title="Send a Slack message" icon="paper-plane" href="/semgrep-appsec-platform/slack-notifications" horizontal />

             <Card title="Call a webhook" icon="globe" href="/semgrep-appsec-platform/webhooks" horizontal />

             <Card title="Require developer exception requests" icon="lock-open" href="/semgrep-appsec-platform/developer-exception-requests" horizontal />
           </CardGroup>

    6. Click **Create & Enable** to save and proceed, so that Semgrep uses your new policy the next time you scan a project within its scope. Otherwise, click **Create** to save your changes without enabling the policy.
  </Step>
</Steps>

## Configure default remediation policies

Some remediation policies are created for you by default and can't be renamed or deleted. They can only be enabled and configured with the actions you choose. Supply Chain incidents, for example, use a dedicated policy called **Early notification for Supply Chain incidents** that already exists for your organization.

<Steps>
  <Step>
    Go to **Rules & Policies > Remediation**, and find the default policy for the feature you want to configure. Click its <Icon icon="ellipsis" iconType="solid" /> icon, then click **Edit policy**.
  </Step>

  <Step>
    Go to **Actions**, and add the **Actions** you want to occur when Semgrep identifies findings and the defined **Conditions** are met.
  </Step>

  <Step>
    Click **Update and enable** to save and proceed, so that Semgrep uses your new policy the next time you scan a project within its scope. Otherwise, click **Update** to save your changes without enabling the policy.
  </Step>
</Steps>

See [Supply Chain incident notifications and response](/semgrep-supply-chain/incident-notifications) for a complete walkthrough of the default Supply Chain incident policy.

## Manage detection policies

<Steps>
  <Step>
    Sign in to [<Icon icon="external-link" iconType="solid" /> Semgrep AppSec Platform](https://semgrep.dev/login).
  </Step>

  <Step>
    Go to **Rules & Policies > Detection**. Find the policy that you'd like to edit, and click **Edit** to open the editor. You can manage your policies for Code rules, Secrets rules, and Supply Chain licenses.
  </Step>

  <Step>
    To modify your detection policy for:

    <Tabs>
      <Tab title="Code and Secrets rules">
        <Steps>
          <Step>
            Find the rules and rulesets you'd like to modify. Filters allow you to narrow the list of rules based on scanning behaviors, languages, rulesets, and more. You can also search for a rule using its name or label.
          </Step>

          <Step>
            To change the behavior of your rules:

            1. Select the rules by clicking the checkboxes next to their names. Then, click **Change scanning behavior (n)**. If you're modifying only one rule, you can click the rule's link in the **Projects scanning** column.
            2. The **Projects scanning** dialog appears. You can choose to use the rules with **All projects**, **Selected projects** by **Project name**, **Selected projects** by **Tags**, **All with exceptions**, or **None (disable)**.
            3. To use the rules with all of your projects, click **All projects**, then click **Save**.
            4. To use the rules with some of your projects, click **Selected projects**, then click the checkboxes next to the projects to which the rule applies. Click **Save** to proceed.
            5. To exclude specific projects, click **All with exceptions**, then select the projects to which the rule doesn't apply. Click **Save** to proceed.
            6. To prevent the rules from being used at all, click **None (Disable)**, then **Save** to proceed.
          </Step>
        </Steps>
      </Tab>

      <Tab title="Supply Chain licenses">
        See [License compliance](/semgrep-supply-chain/license-compliance#view-license-policy) to learn how to view and manage your detection policies regarding Supply Chain licenses.
      </Tab>
    </Tabs>
  </Step>
</Steps>

## Manage remediation policies

<Steps>
  <Step>
    Sign in to [<Icon icon="external-link" iconType="solid" /> Semgrep AppSec Platform](https://semgrep.dev/login).
  </Step>

  <Step>
    Go to **Rules & Policies > Remediation**. You can manage your policies for individual Semgrep products, as well as those that apply to findings from multiple Semgrep products. For policies that apply to multiple products, the policies are triggered whenever the findings meet the criteria that you define.
  </Step>

  <Step>
    Find the Remediation policy that you'd like to edit. Click its <Icon icon="ellipsis" iconType="solid" /> icon, then click **Edit policy**.
  </Step>

  <Step>
    On the **Edit policy** page, you can:

    * Change the **Policy name**.
    * Choose the **Event** that triggers the policy.
    * Define the **Scope**, which is the set of projects to which the policy applies.
    * Define the **Conditions** that trigger the policy.
    * Choose the **Actions** that occur if there are findings that trigger the policy.
  </Step>

  <Step>
    Click **Update** to save and proceed.
  </Step>
</Steps>