After creating the policy, you'll be able to add rules that define what patterns to detect. Rules use regular expressions to match code patterns that violate your policy.