> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/application-security/code-security/code-security-scanners/iac-drift-detection-scans/understand-the-iac-drift-detection-table.md). # Understand the IaC drift detection table The **IaC Drifts** page combines triage widgets with a detailed issue table. Use the widgets to identify priority work. Use the table to investigate and reconcile specific drift issues. Navigate to **Application Security > Issues > IaC Drifts**. ### Widgets Use the widgets to identify and prioritize the highest-severity issues before opening the detailed table. Selecting a widget value filters the table to matching issues. > **Important:** The Drift finding type does not receive Urgency classification. Urgency metrics are calculated only for vulnerability, code weakness, IaC misconfiguration, and secret issues. Prioritize drift issues by severity, by the internet exposure of the drifted resource, and by the criticality of the application the resource supports. #### Severity breakdown The histogram widget charts the count of open issues per severity level. For scanner types that do not calculate Urgency, the widget displays a severity breakdown in place of the Urgency breakdown. Read the proportions rather than the absolute counts. A drift issue is raised against a resource that is deployed by definition, so deployment status does not differentiate one drift issue from another. Severity, internet exposure, and application criticality do. #### SLA Status The **SLA Status** widget groups issues by SLA compliance status. #### Insights Each insight card pairs a severity level with another risk dimension and shows the number of issues matching both conditions. Dimensions include SLA status, internet exposure, application criticality, privileged capabilities, and the cloud account the drifted resource belongs to. `unverified — confirm the insight card set rendered on the IaC Drifts page` > **Note:** Every row in the **IaC Drifts** table represents a live regression. The Drift scanner raises a finding only when the deployed resource violates a security policy that the source template does not violate, so the table contains no code-only or theoretical findings. ### IaC Drifts table The **IaC Drifts** table provides a consolidated view of drift issues. Each row represents an issue created when a scanner finding matches a unified policy. Each row links both sides of the divergence — the IaC resource that declares the intended state and the deployed cloud resource that departed from that state — along with the repository, the cloud account, and the triggering policy. The columns in this table are documented in a shared reference. For descriptions of every available column, the attributes common to all code scan issue tables and the attributes specific to this issue type, see [Issue table attributes reference](/application-security/code-security/code-security-scanners/issue-table-attributes-reference.md). ### Filter and sort the table Use the filter bar at the top of the **IaC Drifts** table to narrow results by any filterable column. Apply the following strategies to scope the table to a working set. | Strategy | Filter | Use when | | ----------------------------------- | ----------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------- | | Focus on impact | **Severity** set to Critical and High | You are establishing the initial working set for a reconciliation cycle | | Focus on public exposure | **Internet Exposed** set to True | The drifted resource accepts traffic from the internet, so the weakened control is externally reachable | | Scope to one cloud account | **Cloud Account** set to a single account | One team owns one account, and you are routing reconciliation work by ownership | | Scope to one repository | **Repository** set to a single value | You are reconciling an entire declared-state baseline in one pass | | Separate untriaged from active work | **Resolution Status** set to New, then to In Progress | You are measuring triage backlog against reconciliation throughput | | Identify recent out-of-band changes | **Created** sorted descending | You are detecting an active pattern of changes applied outside of Git rather than reviewing a historical backlog | > **Note:** Filtering scopes the population; sorting orders it. Apply both. Sorting by **Created** descending is the primary drift-specific ordering, because a cluster of recent drift issues in one account indicates a process failure rather than a set of independent defects. ### Manage issues Right-click a row in the **IaC Drifts** table to access the following actions. | Action | Description | | ------------------------------------------ | ----------------------------------------------------------------------------- | | **Change Status** | Modify the resolution status of the issue. Values: New, In Progress, Resolved | | **Change Severity** | Modify the severity level of the issue. Values: Critical, High, Medium, Low | | **Change Assignee** | Change the user or identity assigned to address the issue | | **Copy text to clipboard** | Copy the selected cell text | | **Copy entire row** | Copy the full row of data | | **Copy issue URL** | Copy the URL of the issue, to share or reference the issue | | **Show/hide rows with the severity level** | Show or hide all rows matching the severity level of the selected row | > **Important:** Resolving a drift issue requires a reconciliation decision in one of two directions. Either update the template to record an intentional change, or revert the deployed resource to the declared state. Setting the status to Resolved without reconciling one side leaves the divergence in place, and the next scan raises the drift again. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/application-security/code-security/code-security-scanners/iac-drift-detection-scans/understand-the-iac-drift-detection-table.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.