Set filters that must be met before the action runs. Available filters depend on the trigger type you selected.

## Issue Filters

Common controls include severity, category, status, scanner kind, associated profiles, and asset tags. **Asset Class** describes a grouping, such as `API_SERVICE` or `FRONTEND`. **Asset Type** describes a type, such as `REST`, `GRAPHQL`, or `WEBSOCKET`.

You can also use a saved table view to apply its filters. The tables below use configuration field identifiers, which can differ from UI labels.

| Fields | Values |
| --- | --- |
| `SEVERITY`, `CATEGORY`, `STATUS`, `RISKS`, `SCANNER_KINDS` | Lists of the corresponding enum values |
| `NAME`, `DOMAINS` | Text |
| `ID`, `SECURITY_TEST_UID`, `SECURITY_TEST_UIDS`, `SCAN_IDS`, `TARGET_IDS` | Lists of issue, security-test, scan, or target identifiers |
| `ASSET_CLASS`, `ASSET_TYPE`, `ASSET_STATUS` | Lists of asset enum values |
| `ASSET_ID`, `PROJECTS`, `TAGS`, `PROFILES` | Lists of asset, project, tag, or profile IDs |
| `JIRA_TICKET`, `AI_FALSE_POSITIVE`, `AGENTIC` | Booleans |
| `LAST_SEEN_AT` | Date/time string |

Issue `TAGS` match tags on the associated asset. **Has Ticket** (`JIRA_TICKET`) checks linked-ticket presence across supported providers.

## Asset Filters

| Fields | Values |
| --- | --- |
| `CLASS`, `TYPE`, `STATUS` | Lists of asset class, type, or status values |
| `ID`, `PROJECTS`, `TAGS`, `INTEGRATIONS`, `PROFILES` | Lists of identifiers |
| `NAME`, `DOMAINS` | Text |
| `MANUALLY_CREATED`, `REPOSITORY_ARCHIVED` | Booleans; archived state applies to repositories |
| `CHILD_OF`, `PARENT_OF` | Related-asset filter with a nullable relationship `verb` |
| `RISKS`, `SCANNER_KINDS`, `ENVIRONMENTS` | Lists of risk, scanner-kind, or environment enum values |
| `CLOUD_PROVIDERS`, `WAF_PROVIDERS`, `CAPTCHA_PROVIDERS` | Lists of provider enum values |
| `VISIBILITY` | Repository visibility values |
| `APEX_DOMAIN` | List of domains |
| `FOUND_BY_PROFILE`, `FOUND_BY_INTEGRATION` | Lists of discovery profile or integration IDs |
| `PORTS` | List of numbers |
| `SEVERITIES`, `FRAMEWORKS` | Lists of severity or framework enum values |
| `LANGUAGES`, `TECHNOLOGY_KEYS` | Lists of strings |

Environment, cloud-provider, WAF, and framework filters apply to services or web applications. CAPTCHA filters apply to web applications. Visibility, archived state, and language filters apply to repositories. Port filters apply to hosts. Use `SEVERITIES` to select assets with issues of the specified severities, and `TECHNOLOGY_KEYS` to select assets using the specified technologies.

## Scan Filters

| Fields | Values |
| --- | --- |
| `STATUS` | List of `STARTING`, `RUNNING`, `CANCELED`, `FINISHED`, `FAILED` |
| `INITIATOR` | List of `APPLICATION_CREATION`, `CI`, `MANUAL`, `SCHEDULED`, `INVENTORY`, `UNKNOWN` |
| `KIND`, `ASSET_TYPE` | Lists of scanner-kind or asset-type values |
| `PROBLEM_SEVERITY` | List of `ERROR`, `WARNING`, `INFO` |
| `PROBLEM_CODE` | List of scan problem codes |
| `PROFILES`, `PROJECTS`, `TAGS` | Lists of identifiers |
| `CREATED_AT` | Date/time string |
| `SEARCH` | Text matched against the profile name or asset name, case-insensitively |
| `IGNORED` | Boolean |

Scan `TAGS` match tags on the profile’s associated asset. Use `PROFILES` in issue or scan filters to select profiles; no workflow trigger targets standalone profile filters.

## Operators and Groups

Combine conditions with **AND** when all must match, or **OR** when any can match. Groups can contain nested AND/OR groups. For example, use AND to select High-severity Open issues, or OR to select High or Critical issues.

Operators depend on the field and resource:

| Fields | Supported Operators |
| --- | --- |
| List fields above | `IS_IN`, `IS_NOT_IN` |
| Issue `NAME` | `MATCHES`, `DOES_NOT_MATCH`, `IS`, `IS_NOT` |
| Issue `DOMAINS`; asset `NAME`, `DOMAINS`; scan `SEARCH` | `MATCHES`, `DOES_NOT_MATCH` |
| Boolean fields | `IS`, `IS_NOT` |
| Issue `LAST_SEEN_AT`; scan `CREATED_AT` | `IS_BEFORE`, `IS_AFTER` |
| Issue/asset `PROJECTS`, `TAGS` | Membership operators plus `IS`, `IS_EMPTY`, `IS_NOT_EMPTY` |
| Issue/asset `PROFILES`; asset `INTEGRATIONS` | Membership operators plus `IS_EMPTY` |
| Scan `PROJECTS`, `TAGS` | Membership operators plus `IS_EMPTY` |
| Asset `CHILD_OF`, `PARENT_OF` | `IS`, `IS_NOT` |
| Asset `APEX_DOMAIN` | Membership operators plus `IS_EMPTY`, `IS_NOT_NULL` |

Use the operators offered for each condition; supported operators vary by field.

## Integration Filters

For **Integration Failed**, saved-view/API filter configuration supports `search` (integration name), `kinds`, `projectIds`, `ids`, `locationIds`, and `github.hasInstallation`. The GitHub option selects integrations with an App installation when set to `true`. The workflow form supports saved-view selection but doesn't expose an integration condition editor.

> [!NOTE]
>
> **Manual Workflows**
>
> Manual workflows don't support filtering since they're triggered manually.