Policy filters#

Caution

Policy filters are only available to Business and Enterprise tier customers.

A policy filter is an additional security measure you can apply to a channel to restrict the available packages that can be sourced from it. You can filter packages by license family, common vulnerability and exposure (CVE) score, CVE status, package age, platform, and by using conda spec. For more information about CVE scores and statuses, see Common Vulnerabilities and Exposures (CVEs).

Creating a policy filter#

  1. From the Channels page, click Create under POLICIES.

  2. Provide a unique name for your policy. Anaconda recommends making it something descriptive.

  3. In the Exclude package if section, click Add filter.

  4. In the FILTER GROUP section that appears, set filter parameters for packages you wish to exclude from channels with this policy.

  5. Click Add Filter to Group to include additional parameters for this filter group, or click Add filter to add a separate filter for this policy.

  6. Repeat this process to apply further package filtering preferences.

  7. If necessary, in the Override exclusions and include a package if section, click Add filter. Here, you can apply filters to include specific packages that would otherwise be excluded by this filter.

    Note

    You can only include packages based on conda spec.

Example policy filter

Let’s say you want to filter out packages with a CVE score greater than 7, but only if their CVE Status has not been Cleared by NIST. Your policy filter would look like this:

Applying a policy filter#

Applying a policy filter to a channel restricts the packages that are able to be sourced from it.

  1. From the Channels page, click Apply beside a channel’s name.

  2. Select a policy to apply to the channel.

  3. Click Apply to confirm.

Once the policy is applied, the status beneath the policy will transition through the following phases:

  • In Queue

  • In Progress

  • Completed

  • Scheduled

The Scheduled status indicates the channel is set to auto-update. This means the filter will be reapplied to the channel every four hours and will update the channel’s contents accordingly.

Note

Remove the policy filter by clicking Remove Policy beside the policy name in the channel list.

Package files that have been removed from a channel due to a policy filter display the specific reasons they were excluded.

Note

Removed files are not grouped, and some packages have multiple pages of files. For packages with many files, it is best to use the search box to narrow results.

Editing a policy filter#

Caution

Policies that are currently in use cannot be edited.

  1. Select the policy name from the POLICIES list.

  2. Change the parameters of the filter as if you were creating a policy.

  3. Click Save.

Note

A warning icon displayed beside your filter indicates that it has become deprecated. Deprecated filters still work, but Anaconda recommends you update your policies to no longer use these filters.

Viewing the policy report#

Once you have applied a policy filter to a channel, view the Policy Report to see a breakdown of the number of package files across various platforms that have been removed, and how many remain.

From the Channels page, click the POLICY RESULTS for any channel to open the Policy Report.

Note

From here, you can download the policy report or the policy report delta in .csv format.

On this page