> ## Documentation Index
> Fetch the complete documentation index at: https://docs.symbioticsec.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure detection

> Configure which vulnerabilities should block CI or be ignored, using our configuration file

Using a configuration file you can tailor detection to your context and focus on what matters most. It lets you define which vulnerabilities are **blocking** in CI (and highlighted as Policy Breaching in the IDE) and which are **ignored** everywhere.

To be taken into account the file must be named `symbiotic.yml` and placed at the root of the repository. Symbiotic will also search parent directories up to the current working directory if the file is not found at the root.

<Note>
  Ignored rules always take priority over blocking rules. If a rule appears in both sections, it will be ignored.
</Note>

***

## File structure

The file has two top-level sections: `blocking` and `ignored`. Both are optional. Each section accepts the same set of filtering criteria.

```yaml theme={null}
blocking:
  severity_threshold: ...
  providers: [...]
  services: {...}
  vulnerabilities: [...]

ignored:
  severity_threshold: ...
  paths: [...]
  languages: [...]
  providers: [...]
  services: {...}
  vulnerabilities: [...]
```

***

## `blocking`

Defines which detections will **fail the CI pipeline** and appear as Policy Breaching in the IDE.

### `severity_threshold`

Blocks all rules at this severity level **and above**.

Accepted values (case-insensitive): `low`, `medium`, `high`, `critical`

```yaml theme={null}
blocking:
  severity_threshold: high   # blocks HIGH and CRITICAL
```

| threshold  | Severities blocked          |
| ---------- | --------------------------- |
| `critical` | CRITICAL                    |
| `high`     | CRITICAL, HIGH              |
| `medium`   | CRITICAL, HIGH, MEDIUM      |
| `low`      | CRITICAL, HIGH, MEDIUM, LOW |

### `providers`

Blocks all rules associated with a cloud provider.

```yaml theme={null}
blocking:
  providers:
    - Azure
    - AWS
```

### `services`

Blocks all rules for specific services within a cloud provider.

```yaml theme={null}
blocking:
  services:
    AWS:
      - s3
      - lambda
    Google:
      - compute
      - gke
```

### `vulnerabilities`

Blocks specific rules by their ID.

```yaml theme={null}
blocking:
  vulnerabilities:
    - TF-0026
    - SYM_PY_001
```

***

## `ignored`

Defines what will be **silently ignored** in the IDE, CLI, and CI — no findings will be reported for these rules or files.

### `severity_threshold`

Ignores all rules at this severity level **and below**.

Accepted values (case-insensitive): `low`, `medium`, `high`, `critical`

```yaml theme={null}
ignored:
  severity_threshold: low    # ignores only LOW
```

| threshold  | Severities ignored          |
| ---------- | --------------------------- |
| `low`      | LOW                         |
| `medium`   | MEDIUM, LOW                 |
| `high`     | HIGH, MEDIUM, LOW           |
| `critical` | CRITICAL, HIGH, MEDIUM, LOW |

### `paths`

Ignores all findings in files matching these patterns. Uses Unix shell-style glob syntax (`*`, `?`, `[seq]`). Paths are relative to the location of `symbiotic.yml`.

```yaml theme={null}
ignored:
  paths:
    - "terraform/azure/storage.tf"   # exact file
    - "azure/sub_folder/*"           # all files in a subdirectory
    - "*/provider.tf"                # provider.tf anywhere in the tree
```

### `languages`

Ignores all rules for a given programming language.

```yaml theme={null}
ignored:
  languages:
    - python
    - go
    - terraform
```

### `providers`

Ignores all rules associated with a cloud provider.

```yaml theme={null}
ignored:
  providers:
    - AWS
```

### `services`

Ignores all rules for specific services within a cloud provider.

```yaml theme={null}
ignored:
  services:
    AWS:
      - lambda
      - s3
```

### `vulnerabilities`

Ignores specific rules by their ID.

```yaml theme={null}
ignored:
  vulnerabilities:
    - TF-0022
    - SYM_PY_001
```

***

## Templates

<CodeGroup>
  ```yaml Minimal theme={null}
  # SYMBIOTIC SECURITY CONFIGURATION FILE
  ignored:
    vulnerabilities:
      # IDs of vulnerabilities you want to ignore in the repository
      - SYM_PY_001
      - SYM_JSTS_003
  ```

  ```yaml Basic theme={null}
  # SYMBIOTIC SECURITY CONFIGURATION FILE
  blocking:
    vulnerabilities:
      # IDs of vulnerabilities that must block CI if detected
      - SYM_PY_001
      - SYM_JSTS_003

  ignored:
    vulnerabilities:
      # IDs of vulnerabilities you want to ignore in the repository
      - SYM_PY_099
      - SYM_JSTS_010
  ```

  ```yaml Full theme={null}
  # SYMBIOTIC SECURITY CONFIGURATION FILE
  # =========================================


  # --------------------------------------------
  # SECTION: blocking
  # Defines what is considered blocking in CI.
  # --------------------------------------------
  blocking:

    # Minimum severity level that will cause a detection to fail the CI pipeline.
    # Accepted values: low, medium, high, critical
    severity_threshold: high

    # List of cloud providers for which *all* related vulnerabilities
    # are treated as blocking, regardless of their individual severity.
    providers:
      - Azure
    #   - AWS
    #   - Google

    # Specific cloud services per provider where *all* vulnerabilities
    # are considered blocking.
    services:
      AWS:
        - s3
      # Google:
      #   - compute
      #   - gke

    # Explicit list of vulnerability IDs that are always treated as blocking.
    # vulnerabilities:
    #   - TF-0444
    #   - SYM_PY_001
    #   - SYM_JS_028


  # ------------------------------------------------------------
  # SECTION: ignored
  # Defines what will be ignored in the IDE and CLI.
  # Ignored rules take priority over blocking rules.
  # ------------------------------------------------------------
  ignored:

    # Maximum severity level below which detections are ignored.
    # Accepted values: low, medium, high, critical
    severity_threshold: low

    # List of file paths or glob patterns to exclude from analysis.
    # Paths are relative to this config file. Wildcards are supported.
    paths:
      - "*/azure/*"

    # Languages to exclude from analysis.
    # languages:
    #   - terraform
    #   - go

    # Cloud providers to exclude entirely.
    # providers:
    #   - Azure
    #   - AWS

    # Specific cloud services to exclude from detection, per provider.
    # services:
    #   AWS:
    #     - documentdb
    #     - elasticache

    # Vulnerability IDs to explicitly ignore.
    # vulnerabilities:
    #   - TF-0010
    #   - SYM_GEN_027
    #   - SYM_PY_004

  # =====================================================
  # END OF CONFIGURATION
  # =====================================================
  # Tips:
  # - Keep this file version-controlled and up to date.
  # - Use comments to document why each rule is ignored or blocked.
  ```
</CodeGroup>