Configure detection

Configure which vulnerabilities should block CI or be ignored, using our configuration file

Using a configuration file you can tailor detection to your context and focus on what matters most. It lets you define which vulnerabilities are blocking in CI (and highlighted as Policy Breaching in the IDE) and which are ignored everywhere.

To be taken into account the file must be named symbiotic.yml and placed at the root of the repository. Symbiotic will also search parent directories up to the current working directory if the file is not found at the root.

Ignored rules always take priority over blocking rules. If a rule appears in both sections, it will be ignored.

---

File structure

The file has two top-level sections: blocking and ignored. Both are optional. Each section accepts the same set of filtering criteria.

blocking:
  severity_threshold: ...
  providers: [...]
  services: {...}
  vulnerabilities: [...]

ignored:
  severity_threshold: ...
  paths: [...]
  languages: [...]
  providers: [...]
  services: {...}
  vulnerabilities: [...]

---

blocking

Defines which detections will fail the CI pipeline and appear as Policy Breaching in the IDE.

severity_threshold

Blocks all rules at this severity level and above.

Accepted values (case-insensitive): low, medium, high, critical

blocking:
  severity_threshold: high   # blocks HIGH and CRITICAL

threshold	Severities blocked
critical	CRITICAL
high	CRITICAL, HIGH
medium	CRITICAL, HIGH, MEDIUM
low	CRITICAL, HIGH, MEDIUM, LOW

providers

Blocks all rules associated with a cloud provider.

blocking:
  providers:
    - Azure
    - AWS

services

Blocks all rules for specific services within a cloud provider.

blocking:
  services:
    AWS:
      - s3
      - lambda
    Google:
      - compute
      - gke

vulnerabilities

Blocks specific rules by their ID.

blocking:
  vulnerabilities:
    - TF-0026
    - SYM_PY_001

---

ignored

Defines what will be silently ignored in the IDE, CLI, and CI — no findings will be reported for these rules or files.

severity_threshold

Ignores all rules at this severity level and below.

Accepted values (case-insensitive): low, medium, high, critical

ignored:
  severity_threshold: low    # ignores only LOW

threshold	Severities ignored
low	LOW
medium	MEDIUM, LOW
high	HIGH, MEDIUM, LOW
critical	CRITICAL, HIGH, MEDIUM, LOW

paths

Ignores all findings in files matching these patterns. Uses Unix shell-style glob syntax (*, ?, [seq]). Paths are relative to the location of symbiotic.yml.

ignored:
  paths:
    - "terraform/azure/storage.tf"   # exact file
    - "azure/sub_folder/*"           # all files in a subdirectory
    - "*/provider.tf"                # provider.tf anywhere in the tree

languages

Ignores all rules for a given programming language.

ignored:
  languages:
    - python
    - go
    - terraform

providers

Ignores all rules associated with a cloud provider.

ignored:
  providers:
    - AWS

services

Ignores all rules for specific services within a cloud provider.

ignored:
  services:
    AWS:
      - lambda
      - s3

vulnerabilities

Ignores specific rules by their ID.

ignored:
  vulnerabilities:
    - TF-0022
    - SYM_PY_001

---

Templates

Minimal

# SYMBIOTIC SECURITY CONFIGURATION FILE
ignored:
  vulnerabilities:
    # IDs of vulnerabilities you want to ignore in the repository
    - SYM_PY_001
    - SYM_JSTS_003