> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/application-security/application-security/appsec-objectives-with-agentix/vulnerability-objectives.md).

# Vulnerability objectives

A vulnerability objective tracks open **vulnerability (CVE) issues** on your code and artifact assets — repositories and container images — toward a remediation goal. You define which assets to cover (the scope) and which vulnerabilities matter (the condition), and Cortex Cloud tracks the matching issues to resolution. Vulnerability objectives are the only objective type available in the current release.

Create a vulnerability objective to track vulnerability (CVE) issues on code and artifact assets — repositories and container images. You can start from a predefined starter prompt or compose a custom prompt. For the full set of asset scope and vulnerability condition filters the AppSec Agent supports, refer to see [Reference A: Objective scope filters](/application-security/application-security/appsec-objectives-with-agentix/references/reference-a-objective-scope-filters.md) and [Reference B: Objective condition filters](/application-security/application-security/appsec-objectives-with-agentix/references/reference-b-objective-condition-filters.md).

##  Vulnerability objective prerequisites

Fulfill the prerequisites for the vulnerability sources you intend to track: 

* Enable the **Application Security SCA scanner**, unless you intend to track only ingested CVE vulnerabilities
* Fulfill any prerequisites required to ingest third-party CVE vulnerability data — for example, onboarding the vendor. For more information refer to [Ingest third-party data sources](/application-security/application-security/onboard-data-sources/ingest-third-party-data-sources.md)

## Vulnerability issue sources

Vulnerability objectives evaluate vulnerability (CVE) issues on **repositories** and **container images**, regardless of how the underlying vulnerability was detected. A vulnerability issue counts toward an objective whether the CVE was found by:

* The **native Cortex Cloud SCA scanner**, which inventories open-source dependencies to detect CVE vulnerabilities in code and artifact assets
* **Ingested SCA data from supported third-party vendors**, such as **Snyk** and **Semgrep**, whose vulnerability findings Cortex Cloud normalizes into the unified data model

## Vulnerability objectives scope

* **Repositories**: Objectives evaluate CVE issues carrying the vulnerability detection method
* **Container images**: Objectives evaluate vulnerability-category issues
* **Exclusions**: License, operational-risk, IaC, secrets, SAST, and CI/CD issues are not counted by vulnerability objectives

NOTE**:**

For the full set of supported filters, see:

* [Reference A: Objective scope filters](/application-security/application-security/appsec-objectives-with-agentix/references/reference-a-objective-scope-filters.md)
* [Reference B: Objective condition filters](/application-security/application-security/appsec-objectives-with-agentix/references/reference-b-objective-condition-filters.md)

## Predefined vulnerability starter prompts

The vulnerability objective type ships with the following predefined starter prompts. Select one from the **AppSec Objectives** tab to create a vulnerability objective without composing a prompt yourself.

* Create an objective for critical vulnerabilities in deployed repositories
* Create an objective for critical vulnerabilities in registry images
* Create an objective for exploitable vulnerabilities in critical applications


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/application-security/application-security/appsec-objectives-with-agentix/vulnerability-objectives.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.