> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm.md).

# Application Security Posture Management (ASPM)

- [What is Application Security Posture Management (ASPM)](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/application-security-posture-management-aspm.md): ASPM centralizes AppSec monitoring across the SDLC. It aggregates findings from tools such as IaC and SCA to provide a holistic view and prioritize risks.
- [Code-to-Cloud](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/code-to-cloud.md): Code-to-Cloud context maps asset lineage across the SDLC. By connecting repos, pipelines, and infra, it provides end-to-end traceability from code to runtime.
- [Core components and mechanisms](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/code-to-cloud/core-components-and-mechanisms.md): Code-to-Cloud context maps asset lineage across the SDLC. By connecting repos, pipelines, and infra, it provides end-to-end traceability from code to runtime.
- [Supported integrations](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/code-to-cloud/supported-integrations.md)
- [Code-to-Cloud context and visibility](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/code-to-cloud/code-to-cloud-context-and-visibility.md): Manage security risk across the SDLC by tracing technical asset lineage. View asset dependencies and runtime context in assets, issues, and policies.
- [Code to Cloud troubleshooting](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/code-to-cloud/code-to-cloud-troubleshooting.md)
- [ASPM Command Center](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/aspm-command-center.md): The ASPM Command Center is your central hub for real-time application security posture management across the SDLC. It offers critical insights to identify risks, track compliance, and enable secure de
- [Operational workflows](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/aspm-command-center/operational-workflows.md)
- [Business applications](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/applications.md): Build and manage applications as holistic entities. Gain centralized visibility across the SDLC to monitor assets and remediate threats based on business risk.
- [Define business applications by Criteria](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/applications/defining-business-applications.md)
- [Define applications by code Criteria](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/applications/defining-business-applications/define-applications-by-code-criteria.md)
- [Reference A: Code Criteria grouping and unification](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/applications/defining-business-applications/define-applications-by-code-criteria/reference-a-code-criteria-grouping-and-unification.md): Understand Code Criteria grouping, scope filters, and application unification.
- [Reference B: Code Criteria references and examples](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/applications/defining-business-applications/define-applications-by-code-criteria/reference-b-code-criteria-references-and-examples.md): Examples and reference rules for Code Criteria grouping, unification, and scope.
- [Define applications by cloud Criteria](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/applications/defining-business-applications/define-applications-by-cloud-criteria.md)
- [View and manage Criteria via the tenant (UI)](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/applications/defining-business-applications/view-and-manage-criteria-via-the-tenant-ui.md)
- [Manage Criteria via the public API](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/applications/defining-business-applications/manage-criteria-via-the-public-api.md)
- [Reference: Core concepts](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/applications/defining-business-applications/reference-core-concepts.md): Reference details for Application Criteria types, evaluation, business context, and application scope.
- [Manually build an application](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/applications/manually-build-an-application.md)
- [View and manage applications (UI)](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/applications/application-management-and-visibility.md)
- [Manage applications via public APIs](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/applications/manage-applications-via-public-apis.md): Automate application lifecycle management by creating, updating, and deleting applications programmatically via the Cortex Cloud public API endpoints.
- [Scope user access to applications (Application SBAC)](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/applications/scope-user-access-to-applications-application-sbac.md)
- [Business application assets](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/applications/business-application-assets.md)
- [Repository as an asset](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/repository-as-an-asset.md)
- [Manage repository assets through the tenant (UI)](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/repository-as-an-asset/understanding-repository-assets-via-the-ui.md)
- [Investigate repository assets](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/repository-as-an-asset/understanding-repository-assets-via-the-ui/investigate-repository-assets.md)
- [Reference: Repositories asset attributes](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/repository-as-an-asset/understanding-repository-assets-via-the-ui/reference-repositories-asset-attributes.md)
- [Manage repositories via API](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/repository-as-an-asset/manage-repositories-via-api.md)
- [Coverage](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/coverage.md): The AppSec Coverage page provides centralized visibility into security scanner deployment across the SDLC. Monitor asset health, identify gaps, and orchestrate onboarding.
- [Coverage in the tenant (UI)](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/coverage/coverage-in-the-user-interface.md)
- [Urgency](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/urgency.md): Prioritize issues using Urgency, a context-aware risk score that dynamically evaluates runtime exposure, business impact, and protection status.
- [Review Application Security posture and remediate issues by Urgency](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/urgency/view-urgency-in-the-tenant.md)
- [Understand Urgency and Code-to-Cloud traceability](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/urgency/urgency-and-code-to-cloud-traceability.md)
- [Understand Urgency metrics](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/urgency/urgency-metrics.md)
- [Prioritize issue types by Urgency level](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/urgency/prioritize-issues-by-urgency-levels.md)
- [Backlog baseline](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/backlog-baseline.md): Backlog represents pre-existing code issues discovered by a scanner's first run or by new rules.
- [Backlog use cases](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/backlog-baseline/backlog-use-cases.md)
- [Issue/Finding classification by scanner](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/backlog-baseline/issuefinding-classification-by-scanner.md)
- [Using Backlog](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/backlog-baseline/using-backlog.md)
- [Service Lead Agreements (SLA)](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/service-lead-agreements-sla.md): Application Security SLA defines deadlines for fixing security issues based on severity, ensuring timely remediation and improving team performance.
- [Configure and monitor Cortex Cloud Application Security SLAs](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/service-lead-agreements-sla/configure-and-monitor-cortex-cloud-application-security-slas.md)
- [Compliance for Cortex Cloud Application Security](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/compliance-for-cortex-cloud-application-security.md)
- [Monitor and track compliance adherence](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/compliance-for-cortex-cloud-application-security/monitor-and-track-compliance-adherence.md)
- [Infrastructure-as-Code (IaC) compliance](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/compliance-for-cortex-cloud-application-security/infrastructure-as-code-iac-compliance.md)
- [Manage IaC compliance](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/compliance-for-cortex-cloud-application-security/manage-iac-compliance.md)
- [CI/CD Compliance](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/compliance-for-cortex-cloud-application-security/cicd-compliance.md): CI/CD compliance ensures adherence to industry standards: CIS GitLab/GitHub and OWASP Top 10.
- [Terraform workflow for Compliance assessments](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/compliance-for-cortex-cloud-application-security/terraform-workflow-for-compliance-assessments.md)
- [Unified Application Security policies](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/unified-application-security-policies.md): AppSec policies define threat responses by setting conditions, scope, and actions. Use out-of-the-box policies or clone them to create custom ones.
- [Tenant (UI) workflow](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/unified-application-security-policies/tenant-ui-workflow.md)
- [Create a policy](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/unified-application-security-policies/tenant-ui-workflow/create-a-policy.md)
- [API workflow](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/unified-application-security-policies/api-workflow.md)
- [Cortex CLI workflow](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/unified-application-security-policies/cortex-cli-workflow.md)
- [IDE workflow](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/unified-application-security-policies/ide-workflow.md)
- [Terraform workflow](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/unified-application-security-policies/terraform-workflow-for-policies.md)
- [View and manage policy details](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/unified-application-security-policies/view-and-manage-policy-details.md)
- [References](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/unified-application-security-policies/references.md)
- [Reference: Core concepts](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/unified-application-security-policies/references/core-concepts.md)
- [Reference A: Finding type details](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/unified-application-security-policies/references/reference-a-finding-type-details.md)
- [Reference B: Condition filters and logic](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/unified-application-security-policies/references/reference-b-condition-filters-and-logic.md)
- [Reference C: Scope mapping details](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/unified-application-security-policies/references/reference-c-scope-mapping-details.md)
- [Reference D: Trigger and actions mapping](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/unified-application-security-policies/references/reference-d-trigger-and-actions-mapping.md)
- [Reference E: Grace period logic and configuration](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/unified-application-security-policies/references/reference-e-grace-period-logic-and-configuration.md)
- [Reference F: Engine evaluation and Urgency logic](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/unified-application-security-policies/references/reference-f-engine-evaluation-and-urgency-logic.md)
- [Reference G: Finding type to trigger mapping](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/unified-application-security-policies/references/reference-g-finding-type-to-trigger-mapping.md)
- [Reference H: Action availability by trigger](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/unified-application-security-policies/references/reference-h-action-availability-by-trigger.md)
- [Reference I: Audit logging](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/unified-application-security-policies/references/reference-i-audit-logging.md)
- [Application Security Rules](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/application-security-rules.md): AppSec rules detect security threats using predefined criteria based on standard compliance frameworks and best practices. Custom rules are supported.
- [Tenant (UI) workflow](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/application-security-rules/tenant-ui-workflow.md): Manage Application Security rules through the Cortex Cloud tenant.
- [Understand and investigate rules](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/application-security-rules/tenant-ui-workflow/rules-inventory.md)
- [Create custom Cortex Cloud Application Security rules](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/application-security-rules/tenant-ui-workflow/create-custom-cortex-cloud-application-security-rules.md)
- [Configure YAML file properties](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/application-security-rules/tenant-ui-workflow/create-custom-cortex-cloud-application-security-rules/configure-yaml-file-properties.md)
- [API workflows for rules](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/application-security-rules/api-workflows-for-rules.md): Manage Application Security rule definitions through the public API.
- [Terraform workflows for rules](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/application-security-rules/terraform-workflows-for-rules.md)
- [Manage custom rules](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/application-security-rules/manage-custom-rules.md)
- [Manage SAST code weakness issues](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/manage-code-weakness-issues.md): Ingest third-party SAST findings to create actionable issues, enabling you to prioritize and track remediation and enhancing your security posture.
- [Navigate to SAST code weakness issues](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/manage-code-weakness-issues/navigate-to-sast-code-weakness-issues.md)
- [Understand the Code Weaknesses table](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/manage-code-weakness-issues/understand-the-code-weaknesses-table.md)
- [Investigate and remediate code weakness issues](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/manage-code-weakness-issues/investigate-and-remediate-code-weakness-issues.md)
- [Code weakness findings](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/manage-code-weakness-issues/code-weakness-findings.md)
- [Manage the third-party data lifecycle](https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm/manage-the-third-party-data-lifecycle.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/application-security/application-security-posture-management-aspm.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.