> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/application-security/code-security/application-security-scans-management/manage-scans-through-the-tenant-ui/branch-periodic-scans/branch-periodic-scan-workflow/investigate-a-scan-result-prioritize-the-issues-and-remediate.md).
# Investigate a scan result, prioritize the issues, and remediate
Open a scan result to determine what the scan found, establish which issues to work first, and remediate each issue directly within the scan. Start by opening your scans in order of repository business criticality.
For large repositories, issues may span multiple categories (such as secrets and vulnerabilities). Because the scan side panel does not provide a single ranked list across categories, prioritize in two stages: first across categories using the **Overview** tab, and then within each category using tabs.
Prioritize by Urgency (when the scan category supports Urgency), and use Severity as the tie-breaker within an Urgency tier. For detailed information about Urgency, refer to [Urgency](/application-security/application-security-posture-management-aspm/urgency.md).
{% hint style="info" %}
This deep-dive method focuses on a single scan result. To triage across your entire portfolio at scale instead, go to **Application Security** > **Issues** to view multi-repository tables with built-in risk dimensions. Refer to [Code Security scanners](/application-security/code-security/code-security-scanners.md) for more information.
{% endhint %}
```mermaid
flowchart TD
A[Select scan row in criticality order] --> B[Overview: size the work
severity totals and which tabs are populated]
B --> C[Sweep: open each populated table]
C --> D{Does this table
carry Urgency?}
D -->|Vulnerabilities, Secrets,
IaC Misconfigurations| E[Filter Urgency high to low
record the highest tier returning a row]
D -->|CI/CD Risks, Licenses,
Package Operational Risk,
Malicious Packages| F[Filter Severity high to low
record the highest severity returning a row]
E --> G{Rank 1 to 3 work found,
or all tables swept?}
F --> G
G -->|No| C
G -->|Yes| H[Assign each issue a single rank
first matching row wins]
H --> I[Work the ranks in order]
I --> J[Select an issue and investigate]
J --> K[Remediate from the Resolution tab]
K --> L{Ranks remaining?}
L -->|Yes| I
L -->|No| M[Scan triaged
track SLA in the category issue table]
```
#### Procedure
1. Select a scan row in the Branch Periodic Scans inventory: Open the scans in the business criticality order recorded in [Assess scan coverage and health across the portfolio](/application-security/code-security/application-security-scans-management/manage-scans-through-the-tenant-ui/branch-periodic-scans/branch-periodic-scan-workflow/assess-scan-coverage-and-health-across-the-portfolio.md), so the repositories belonging to the most critical applications are triaged first.\
The side panel opens, titled with the repository name and the branch name in parentheses, such as `my-repo (main)`.
2. Review the **Overview** tab to establish the scope of the result and the scale of the work:
* **Organization**, **Repository**, and **Scanned Branch** identify the code context of the scan
* **Scan Date** records when the scan started
* **Scan Health** reports execution health, and presents a **Rescan** control when the health value is **Error** or **Partially** (completed). Establish that the scan health reads **Completed** before treating the counts as a full result — see [Triage a scan that failed or completed partially](/application-security/code-security/application-security-scans-management/manage-scans-through-the-tenant-ui/branch-periodic-scans/branch-periodic-scan-workflow/triage-a-scan-that-failed-or-completed-partially.md)
* **Issues** and **Findings** report Critical, High, Medium, and Low counts for the scan as a whole. Read the **Issues** counts to size the work the scan represents. The counts do not schedule the work. Scheduling follows the prioritization you apply per category at step 5, which the **Overview** tab does not report.
* **Issues By Type** and **Findings By Type** report counts per scanner category, which identifies the category tabs that hold results
3. Decide which issue category to investigate first:
| Table | Ranking axis | Action in the table | Record |
| -------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------- |
| **Vulnerabilities**, **Secrets**, **Configurations** > **IaC Misconfigurations** | Urgency, Severity as tie-breaker | Filter **Urgency** to **Top Urgent**. Where the filter returns no row, filter to **Urgent**, then to **Not Urgent**. | The highest Urgency tier that returns a row, and the highest severity within that tier |
| **Configurations** > **CI/CD Risks**, **Package Integrity** > **Licenses**, **Package Integrity** > **Package Operational Risk**, **Malicious Packages** | Severity, category-specific signal as tie-breaker | Filter **Severity** to **Critical**, then to **High**, until a filter returns a row. | The highest severity that returns a row, and the category-specific signal named in step 5 |
- Two tabs present two tables rather than one: Configurations presents IaC Misconfigurations and CI/CD Risks, and Package Integrity presents Licenses and Package Operational Risk
- The issue categories do not correspond one-to-one with the configurable scanners. See Reference G: Scanner to issue category mapping