Vulnetix
Try Vulnetix Request Demo

Rego rules for vulnetix scan

Index of every .rego rule across the official plugin repos. Each ruleset clones from a public Git URL and loads with one --rule flag.

$ vulnetix scan --rule vulnetix/opa-fugue-regula

Available rulesets

vulnetix/opa-fugue-regula

275 rules · Terraform, CloudFormation, Kubernetes manifests, ARM templates.

--rule vulnetix/opa-fugue-regula

vulnetix/community-rules

243 rules · curated index of community rule packs across Terraform, Kubernetes, Dockerfile, OpenAPI.

--rule vulnetix/community-rules

vulnetix/opa-checkmarx-kics

203 rules · KICS misconfiguration coverage for Terraform, Ansible, Dockerfile.

--rule vulnetix/opa-checkmarx-kics

vulnetix/opa-aquasecurity-trivy

107 rules · Trivy IaC misconfiguration checks for Docker and Kubernetes.

--rule vulnetix/opa-aquasecurity-trivy

vulnetix/opa-cigna-tf

47 rules · AWS Terraform controls for ACM, API Gateway, CloudFront, IAM, RDS.

--rule vulnetix/opa-cigna-tf

vulnetix/opa-cds-aws-tf

16 rules · CDS hardening for IAM, RDS, CloudFront, WAF, ECS, Lambda.

--rule vulnetix/opa-cds-aws-tf

vulnetix/opa-snyk-labs-iac

6 rules · reference IaC custom rules — AMI allowlists, password policies, S3 controls, required tagging.

--rule vulnetix/opa-snyk-labs-iac

Authoring

  1. Repo with a rules/ directory at the root. Subdirs walked recursively. _lib/ reserved for shared helpers.
  2. Each .rego file declares metadata := {...} and a findings set. Required metadata: id, name, description, languages, severity, kind.
  3. Push to any Git host. Load with --rule org/repo. Override the registry via --rule-registry <url> for GitLab, Gitea, GHE, or SSH.

Cache lives at ~/.cache/vulnetix/rules/<org>/<repo>/ on Linux. Pulls automatically on subsequent runs.

Authoring guide →