> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/application-security/code-security/code-security-scanners/software-composition-analysis-sca-scanners/license-miscompliance-issues/understand-the-licenses-table.md). # Understand the Licenses misconfigurations table The **Licenses** page combines triage widgets with a detailed issue table. Use the widgets to identify priority review work. Use the table to investigate and remediate specific license miscompliance issues. **Scope:** This page describes what the **Licenses** widgets chart, what each column holds, how to scope the table, and what each row action does. Navigate to **Application Security > Issues > Licenses**. ### Widgets Use the widgets to identify and prioritize the most urgent review work before opening the detailed table. Selecting a widget value filters the table to matching issues. > **Important:** License miscompliance issues do not receive Urgency classification. Urgency metrics are calculated only for vulnerability, code weakness, IaC misconfiguration, and secret issues, and a license obligation measures neither exploitability nor deployment exposure. The **Licenses** page therefore displays a severity breakdown in place of an Urgency breakdown, and insights are defined on severity. Prioritize license issues by severity, license category, and whether the package ships in a distributed artifact. #### Severity breakdown The severity widget charts the count of open issues per severity level. Read the proportions rather than the absolute counts. `unverified — confirm the widget label on the Licenses page` #### SLA Status The **SLA Status** widget groups issues by SLA compliance status. #### Insights Each insight card pairs a severity level with another compliance dimension and shows the number of issues matching both conditions. Dimensions include SLA status, license category, dependency type, and OSI approval status. `unverified — confirm the insight card set rendered on the Licenses page` ### Licenses table The **Licenses** table provides a consolidated view of license miscompliance issues. Each row represents an issue created when a scanner finding matches a unified policy. Each row links the license to the open-source package the license is attached to, the dependency manifest file, the repository, the detection rule that matched, and the triggering policy. The columns in this table are documented in a shared reference. For descriptions of every available column, the attributes common to all code scan issue tables and the attributes specific to this issue type, see [Issue table attributes reference](/application-security/code-security/code-security-scanners/issue-table-attributes-reference.md). ### Filter and sort the table Use the filter bar at the top of the **Licenses** table to narrow results by any filterable column. Apply the following strategies to scope the table to a working set. | Strategy | Filter | Use when | | -------------------------------------------- | ------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------- | | Focus on the strongest obligations | **License Category** set to strong copyleft | Strong copyleft imposes derivative work disclosure obligations, which is the highest-cost obligation to discover after distribution | | Focus on unquantified risk | **License** set to Unknown, or **OSI Approved** set to False | An unrecognized license carries unquantified legal risk and requires legal review before the package can be cleared | | Scope to distributed software | **Branch** set to the release branch | An obligation attaches on distribution. A dependency confined to an internal tool carries a different obligation profile than one that ships | | Scope to one package | **Package** set to a single value | One dependency replacement resolves every issue attached to that package | | Separate direct from transitive dependencies | **Dependency Type** set to Direct | A direct dependency can be replaced by the owning team; a transitive one requires resolving the root package first | | Separate untriaged from active work | **Resolution Status** set to New, then to In Progress | You are measuring legal review backlog against replacement throughput | > **Note:** Filtering scopes the population; sorting orders it. Apply both. License review is category work rather than instance work — filter by **License Category** first, then sort within the category, so that legal review produces a reusable ruling per license rather than a ruling per package. ### Manage issues Right-click a row in the **Licenses** table to access the following actions. | Action | Description | | ------------------------------------------ | ----------------------------------------------------------------------------- | | **Change Status** | Modify the resolution status of the issue. Values: New, In Progress, Resolved | | **Change Severity** | Modify the severity level of the issue. Values: Critical, High, Medium, Low | | **Change Assignee** | Change the user or identity assigned to address the issue | | **Copy text to clipboard** | Copy the selected cell text | | **Copy entire row** | Copy the full row of data | | **Copy issue URL** | Copy the URL of the issue, to share or reference the issue | | **Show/hide rows with the severity level** | Show or hide all rows matching the severity level of the selected row | > **Note:** Assign license issues to the legal or compliance reviewer rather than to the developer who added the dependency. The remediation decision — accept the obligation, replace the dependency, or negotiate a commercial license — is a legal determination, and the code change follows from it. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/application-security/code-security/code-security-scanners/software-composition-analysis-sca-scanners/license-miscompliance-issues/understand-the-licenses-table.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.