# Legacy Violations To streamline the process of onboarding new applications with existing policy violations, the Legacy Violation feature allows you to defer policy violations to remediate later. When enabled for an application or an application's parent organization, eligible policy violations are marked as Legacy Violations on the first evaluation of an application. Legacy Violations will not be treated as active violations, no notifications will be sent and Lifecycle will not take policy actions against them. If desired, these legacy violations can also be revoked to return to normal policy violation behavior. ## What are Legacy Violations? This Lifecycle feature lets you acknowledge existing issues found in newly onboarded applications. The main objective of Legacy Violations is to provide an easier route to automated enforcement of new risks, which is difficult to achieve if there’s a large backlog of existing issues. When violations are marked as Legacy, existing violations won’t cause a policy action, but if a new violation is introduced the policy action is still applied. Here’s an example of how new application onboarding might work with Legacy Violations enabled: 1. A policy administrator configures policies with a build action of fail and enables Legacy Violations at the root organization level. 2. An application is scanned for the first time, showing components A and B, revealing violations A2 and B2. Since Legacy Violations is enabled, these violations are automatically deferred. No policy action is taken during this first scan, allowing the build to pass. 3. Component C is added later or upgraded to a newer version, and that shows new violations and fails the build. In the above example, the first evaluation is used to assess an application. Although there are violations, they represent existing risks and are marked as _Legacy Violations_. The build continues to pass with these violations until the new component is added revealing new violations that fail the build. **Note** By default, _Legacy Violations_ do not defer violations of severity 9 or 10 because these violations represent significant risks. ## Difference Between Waivers and Legacy Violations A good way to think about _Legacy Violations_ is that it lets you exempt existing risks you had before adopting Lifecycle. On the other hand, waivers are a way to individually exempt new risks after Lifecycle is deployed. With _Legacy Violations_ enabled, you won’t get overwhelmed with violations, but you will be aware that the violations exist. It’s different from waiving in this way. Waivers acknowledge a variance in policy for a specific component, whereas _Legacy Violations_ is a way to acknowledge the existing state of the application prior to onboarding with Lifecycle. With Legacy Violations, you can easily get to a logical, approachable scope when you get started and have time to remediate risk. ## Configuring Legacy Violations for Organizations and Applications By default, _Legacy Violations_ feature is disabled on the Root Organization, and this setting is inherited by all child organizations and applications. However, the default _Legacy Violation_ configuration for the Root Organization also permits overrides by child organizations and applications, so this setting can be overridden. You can enable or disable _Legacy Violations_ for an organization or an application if there are no inherited restrictions on overriding the setting. To enable or disable _Legacy Violations_ for an application or organization: 1. Select the organization or application that you wish to edit from the sidebar. 2. Scroll down to the _Policies section_ and click on _Legacy Violations_. The options will vary slightly depending on whether you are editing the Root Organization, a child organization, or an application. - For the Root Organization, you can select whether or not _Legacy Violation_ status is enabled or disabled, and whether or not child organizations and applications can override this setting. - For child organizations, you can select whether or not _Legacy Violation_ status is enabled, disabled, or inherited from the parent, as well as whether or not applications can override this setting. - For applications, you can select whether or not _Legacy Violation_ status is enabled or disabled. If a parent organization has disabled overrides then the settings from that parent will be inherited and the user interface for editing the configuration will be disabled with a message indicating the reason. ## Configuring Legacy Violations for Policies You will also need to enable or disable _Legacy Violations_ on individual policies. To do so, follow the directions in [Configuring Policies](https://help.sonatype.com/en/configuring-policies.html) for editing a policy. For new installs, Legacy Violations are enabled in the reference policies for threat levels less than or equal to 8. **Note** For any policy violations to be managed as _Legacy Violations_, it must also be enabled by configuring the application or parent organization. **For Firewall** Legacy Violations is a Lifecycle feature and not intended for use with Repository Firewall policy enforcement. For Firewall use cases, policy actions (including quarantine and audit) should be configured without relying on Legacy Violations. ## Viewing Legacy Violations Information regarding Legacy Violations is displayed in several locations within the Sonatype Lifecycle. ### Application Composition Report The number of _Legacy Violations_ will be displayed in the [Application Composition Report](https://help.sonatype.com/en/application-composition-report.html). Individual legacy violations are also displayed on the Policy Violations table when [reviewing a report](https://help.sonatype.com/en/reviewing-a-report.html). The _Legacy_ filter can be used to limit results to Legacy Violations. ### Dashboard _Legacy Violations_ can also be viewed using the filters on the [Dashboard](https://help.sonatype.com/en/lifecycle-dashboard.html). Select the _Violation State_ filter in the sidebar and select the _Legacy_ checkbox to include Legacy Violations in dashboard results. ### PDF Report The number of _Legacy Violations_ appears in the [PDF Report](https://help.sonatype.com/en/pdf-report.html) under the _Scope of Analysis_ section. ### Notification Emails Notification emails that are sent for policy violations will contain the number of Legacy Violations. ## Assigning Existing Policy Violations as Legacy Violations Existing policy violations can be set as Legacy Violations at the application level. Subsequent evaluations will treat these policy violations as Legacy Violations, but this action does not perform a new evaluation. This action will only be available if _Legacy Violation_ is enabled or inherited for the application. For existing policy violations for an application: 1. Select the application from the sidebar. 2. Click the _Legacy Violations _ item in the Actions menu. A modal dialog will ask you to confirm the action before proceeding. ## Revoking Legacy Violation status Violations for applications that have been assigned _Legacy Violation_ status can be revoked. Subsequent scans and re-evaluations will include these policy violations if applicable, but existing reports will not change. To revoke _Legacy Violation_ status for an application: 1. Click _Orgs and Policies_ on the left sidebar. 2. Select the application. 3. Click the _Actions_ menu in the top right and select _Revoke legacy status._ 4. Click _Revoke_ in the dialog box.