> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/application-security/code-security/application-security-scans-management/manage-scans-through-the-tenant-ui/branch-periodic-scans/references/reference-f-scan-configuration-settings.md).

# Reference F: Scan configuration settings

The repository scan configuration controls which scanners run against the repository and how scanning behaves.

The scanners enabled in the repository scan configuration do not correspond one-to-one with the issue categories reported in the scan results. One scanner produces four categories, and one category is produced by a scanner that the repository scan configuration does not control. Use this mapping to relate a configuration setting to the results the setting produces.

| Configured scanner | Tab and table produced                                                                                                                  | Note                                                                                                                                                                                                                                                                                 |
| ------------------ | --------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **IaC**            | **Configurations** > **IaC Misconfigurations**                                                                                          | Produces IaC misconfiguration detections in Terraform, CloudFormation, Kubernetes, and Helm templates.                                                                                                                                                                               |
| **SCA**            | **Vulnerabilities**; **Package Integrity** > **Licenses**; **Package Integrity** > **Package Operational Risk**; **Malicious Packages** | One scanner populates four tables across three tabs. CVE detections appear under **Vulnerabilities**, license miscompliance under **Licenses**, unmaintained and deprecated packages under **Package Operational Risk**, and malicious package matches under **Malicious Packages**. |
| **Secrets**        | **Secrets**                                                                                                                             | Detects credentials in the working tree, and in commit history when **Git History Scan** is enabled.                                                                                                                                                                                 |
| **CI/CD**          | **Configurations** > **CI/CD Risks**                                                                                                    | Produced by the CI/CD scanner, which is not a setting in the repository scan configuration in Reference E: Scan configuration settings. Confirm CI/CD scanner activation on the AppSec Coverage page rather than in the repository scan configuration.                               |

## What happens when you disable the native SCA scanner?

Disabling the native SCA scanner affects risk categories differently depending on whether you use third-party vendors:

* **License Miscompliance, Package Operational Risk, and Malicious Packages**
  * **Status:** Coverage is lost entirely
  * **Why:** These risks are detected only by the native SCA scanner. Third-party vendor integrations drop this data, so no third-party setup can restore these categories while the native scanner is off
* **Vulnerabilities (CVEs)**
  * **Status:** Detections may still appear
  * **Why:** Ingested third-party findings will continue to generate CVE issues even with the native scanner disabled
  * **Warning:** An empty category does not mean your repository is safe, nor does a populated list mean the native scanner ran. Before interpreting your results, always confirm which scanners and third-party integrations are currently active

**Recommendation:** If you require full coverage (CVEs plus license, operational risk, and malicious package detection), run the native SCA scanner alongside your third-party vendor in parallel.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/application-security/code-security/application-security-scans-management/manage-scans-through-the-tenant-ui/branch-periodic-scans/references/reference-f-scan-configuration-settings.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.