> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/application-security/code-security/application-security-scans-management/manage-scans-through-the-tenant-ui/branch-periodic-scans.md). # Branch periodic scans Branch periodic scans establish the security baseline for every onboarded repository. Branch periodic scans run automatically at a fixed interval against the scanned branch, evaluate the existing codebase with every enabled Cortex Cloud Application Security scanner, and convert detections into issues. Use branch periodic scans to answer one question with evidence: which repositories are fully scanned, and what did the most recent scan find. The Branch Periodic Scans inventory presents scan results and supports rescanning; the inventory does not resolve issues. Issue resolution occurs in the dedicated issue inventory for each issue type. ## Prerequisites | Prerequisite | Requirement | | --------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Application Security module** | The Cortex Cloud Application Security module is active for the tenant | | **VCS integration** | At least one Version Control System integration (GitHub, GitLab, Bitbucket, Azure Repos) is connected, and the integration instance status is **Connected** | | **Repository onboarding** | At least one repository is onboarded through the VCS integration. A repository that is not onboarded is never scanned and produces no row in the scan inventory | | **Scanner enablement** | At least one scanner (IaC, SCA, Secrets) is enabled in the repository scan configuration. A repository with every scanner disabled produces no findings | | **Application Security Periodic `View` permission** | Required to view periodic scan results | | **Application Security Periodic `View/Edit` permissions** | Required to trigger a rescan. A user holding only the view permission can read scan results and must escalate a rescan to a user holding the edit permission | ## Core achievements * **Establishing a defensible baseline:** Converting the committed state of every scanned branch into a measured posture rather than an assumed one * **Reducing silent coverage gaps:** Distinguishing a repository that scanned clean from a repository whose scanner never executed * **Routing detections to remediation:** Directing each issue category to the issue inventory that owns resolution for that category * **Restoring failed coverage:** Diagnosing scan failures to a specific cause — permission, token, clone, connection, or webhook — and correcting the cause rather than repeating the failure #### Shift-left position Branch periodic scans are the baseline enforcement point in the shift-left lifecycle (IDE → PR → CI → **Periodic** → Runtime). A finding blocked at pull request scan or CI scan never reaches the periodic scan baseline. A finding that does reach the periodic baseline represents risk already committed to the scanned branch. Treat a growing periodic baseline as a signal to strengthen enforcement at the pull request stage. ## Core concepts Branch periodic scans have four concepts that shape accurate risk assessment. * **Scan signals:** Scan health shows execution status. Scan status applies only to CI and pull request scans * **Coverage:** Inventory rows represent scan results, not total onboarded repository coverage * **Findings and issues:** Findings are detections. Issues are policy-matched records for remediation * **Urgency:** Not every issue carries Urgency. Supported issues receive Urgency on the next periodic scan cycle Refer to [Reference A: Branch periodic scan concepts](/application-security/code-security/application-security-scans-management/manage-scans-through-the-tenant-ui/branch-periodic-scans/references/reference-a-branch-periodic-scan-concepts.md) for details. ## How to access branch periodic scans Under **Modules** select **Application Security** → **Branch Periodic Scans**. ## Workflow Follow the workflow to review scan results, validate coverage, and route issues for remediation. [Open the Branch periodic scan workflow](/application-security/code-security/application-security-scans-management/manage-scans-through-the-tenant-ui/branch-periodic-scans/branch-periodic-scan-workflow.md). ## References Use [References](/application-security/code-security/application-security-scans-management/manage-scans-through-the-tenant-ui/branch-periodic-scans/references.md) for detailed scan information, such as inventory table attributes, scan health values, health error types and more. ## Next step [Branch periodic scan workflow](/application-security/code-security/application-security-scans-management/manage-scans-through-the-tenant-ui/branch-periodic-scans/branch-periodic-scan-workflow.md). --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/application-security/code-security/application-security-scans-management/manage-scans-through-the-tenant-ui/branch-periodic-scans.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.