How to use the Cortex Cloud extension

The Cortex Cloud security extension for VS Code integrates comprehensive scanning, efficient issue management, and remediation capabilities directly into your coding environment, without disturbing development.

Understand the interface

The Cortex Cloud extension divides the Visual Studio Code workspace into three panes. Each stage of the workflow is performed in a specific pane, and the panes are referenced by name throughout this guide.

Select the Cortex Cloud icon in the extension panel to open the extension.

Pane	Position	Function
Navigation panel	Left	Displays a tree structure of issues by security category: IaC misconfigurations, Secrets, Vulnerabilities (SCA), Licenses and Package Operational Risk. Expand a category to reveal the folders containing the issues detected during a scan.
Code editor	Middle	Displays the codebase, the issues related to resources (for IaC misconfigurations) or files, and the remediation options.
Problems Tool	Right	Displays detailed information about a selected issue, including code differences when available, and remediation options.

Workflow

Stage	Decision	Primary surface
Scan	Whether to analyze the whole project or a single file	Play button in the Navigation panel
Understand	Which security categories carry issues, and where the issues live	Category tree in the Navigation panel
Prioritize	Which issue to work on next	Filter icon in the Navigation panel
Investigate	What the issue is and where the issue lives in the code	Problems Tool and the Code editor
Remediate	Whether to fix, suppress, or consult documentation	Fix, Suppress, and Documentation actions

Scan

Scan your code for security issues using two primary methods: full project scans and single file scans. Select the method by the size of the change under review.

Method	Trigger	Use when
Full project scan	Click the Play button for any security category in the Navigation panel	Establishing or re-establishing the baseline issue set — at the start of a working session, or after a broad change such as a dependency upgrade or a merge
Single file scan	Triggered automatically when you open or save that file	Validating a focused edit without re-analyzing the entire project

Important: The Play button initiates scans across all security categories, not only the category the Play button belongs to. Clicking Play on the Secrets category produces a complete result set covering IaC misconfigurations, Secrets, Vulnerabilities (SCA), and Licenses.

Confirm the scan covered what you intended. The Navigation panel tree does not distinguish a full project result set from a single file result set. A tree populated by a save-triggered single file scan looks the same as a tree populated by a full project scan. Before treating the tree as a project-wide baseline, click Play and allow the scan to complete.

Understand the results

The Navigation panel displays a tree structure of issues according to security category: IaC misconfigurations, Secrets, Vulnerabilities (SCA), and Licenses. Read the tree before selecting any individual issue — the category structure describes the distribution of the result set and determines where to commit attention.

• Expand a security category to reveal the folders containing the specific issues detected during a scan.
• Issues are grouped by security category, which makes the categories the primary browsing axis.
• Click a category or a folder to view the associated issues.

Confirm the scope of the result set. A single file scan reports issues only for the file that was opened or saved. Before treating the tree as a project-wide baseline, click the Play button in the Navigation panel to run a full project scan across all categories.

Important: An empty category is not proof that the category is clean. A scanner disabled in cortexCloud.scanners, a path excluded by cortexCloud.excludePaths, or a severity floor set in cortexCloud.severityThreshold each removes issues from the tree without any indication in the tree itself. See When a scan result is unreliable before concluding that a category carries no risk.

Prioritize

Prioritize and address the most critical issues by filtering the scan results based on category and severity. Apply both — the category narrows the result set to a single risk class, and severity establishes the order of risk within that class.

Filter	Control	Use when
Security category	Category node in the Navigation panel	Isolating a single risk class, such as clearing all Secrets issues before a commit.
Severity level	Filter icon in the Navigation panel	Ordering the queue by risk. Start at the highest severity and work down.

Caution: The severity filter in the Navigation panel and the cortexCloud.severityThreshold setting are two separate controls. The filter changes what the tree displays. The threshold suppresses issues below a severity floor before they reach the tree. Clearing the filter does not clear the threshold.

Sequence the queue. Filter to the highest severity first. Within that severity, open each issue and check the Problems Tool for a suggested fix — IaC misconfigurations and SCA CVE vulnerabilities carry automated fixes, while Secrets and License issues do not. Clear the issues that carry a fix, then work the remainder, which require a manual decision: suppression or policy-guided mitigation. Lower the severity filter one tier and repeat.

Order within a severity tier by issue evidence. Severity alone does not separate two issues of the same rank. Use the evidence the scanner attaches to each issue — a validated-active secret outranks an unvalidated one, and a CVE with an available fix version outranks one without. For the evidence fields each scanner produces, see Issue categories.

Note: Severity is a static classification. When Visual Studio Code scan results are uploaded to the Cortex Cloud platform, the Urgency engine supersedes severity by combining it with Code-to-Cloud deployment context, exploit intelligence, and business criticality. Urgency is computed server-side and is not available in the IDE — use severity and issue evidence for local sequencing, and Urgency for platform-level prioritization.

Investigate

An issue count tells you that risk exists. Investigation establishes what the issue is and where the issue lives in the code, which determines the remediation path.

Open the issue.

1. Under a security category in the Navigation panel, expand the folders to locate the issues.
2. (Optional) Use the filter icon in the Navigation panel to refine the issues by severity.
3. Select an individual issue to display the issue details in the Code editor and the Problems Tool.

Read the issue in the Code editor. The extension highlights secrets, misconfigurations, vulnerabilities, and license non-compliance issues with red marks next to the affected lines.

• Hover over a red mark to view the issue details, severity, and remediation options.
• For multiple issues at the same location, scroll to view all detected issues.
• Click Console to open the Problems Tool and explore further information about the detected issue.

Read the issue in the Problems Tool. The Problems Tool provides a detailed view of the selected issue, including the code differences when available and the remediation options. Open the Problems Tool by selecting an issue in the Navigation panel, or through the Console option in the Code editor.

Important: For an IaC resource carrying several misconfigurations, the hovered list at the affected line determines the remediation effort. A single configuration block carrying several misconfigurations is one edit against several issues — scroll the full hovered list before applying any fix.

Remediate

Mitigate issues directly through both the Code editor and the Problems Tool. Options include Fix, Suppress, and Documentation.

Path	Use when
Fix	A suggested fix is displayed for the issue. The fastest path — the fix is applied to the code on selection.
Suppress	No fix is available, or the issue is not the current priority, and the issue is an accepted risk for the file.
Documentation	No automated fix is available and the mitigation approach is unclear.

Note: Not all remediation options are available for all issues.

Apply a fix

When selecting an issue in either the Code editor or the Problems Tool, a suggested fix is displayed when available. Fixes are applied automatically upon selection.

Caution: Selecting a suggested fix modifies your source file. Review the code difference displayed in the Problems Tool before selecting the fix, and confirm the resulting change against version control before committing. This applies with particular force to an SCA fix, which changes a dependency version in your package manifest.

Issue category	Fix behavior
IaC misconfigurations	The fix modifies the configuration. The Problems Tool displays the code difference to be fixed.
SCA CVE vulnerabilities	The fix bumps the package version. Fix the specific vulnerability detected during the scan by upgrading the package to the version that includes a fix.
Secrets issues	No automated fix. Follow the policy guidelines. For rotation guidance, see Secrets issues.
License mis-compliance	No automated fix. Follow the policy guidelines. For handling guidance, see License compliance issues.

Suppress an issue

Suppress an issue to temporarily hide or ignore an issue without fixing it, allowing you to concentrate on more important issues. The suppression is scoped to the file.

1. Select an issue from the Navigation panel → click Suppress in either the Code editor or the Problems Tool.
2. Provide a justification for the suppression → press Enter to confirm.

The justification will be added as a commented annotation to your source code. Write the justification for a reviewer, not for yourself — the annotation is committed with the code and is the only record of the risk-acceptance decision.

Warning: A suppression created in Visual Studio Code is not local to the IDE. The committed annotation is recognized by every scanning stage — the Cortex CLI, CI/CD scans, and periodic platform scans all honor the suppression. Suppressing an issue in the IDE silences that issue across the entire lifecycle, so treat the decision as organizational risk acceptance rather than a local display preference.

Caution: After suppressing an issue, the file will not be scanned for two minutes. This is to prevent the issue from being re-triggered. Saving the file during the hold period will not trigger a scan. Wait out the hold period before treating a subsequent clean save as verification.

For information on developer suppression refer to Developer suppressions.

Consult the documentation

If automated fixes are not available, policy documentation can provide guidance on how to address the issue. Select an issue → click Documentation in either the Code editor or the Problems Tool. You are redirected to the relevant policy documentation, which includes suggested guidelines on how to solve the issue.

Extension actions

Find extension actions under the Cortex Cloud section of the Navigation panel. Every action operates on the extension as a whole, not on an individual issue.

Action	Use when
Play	Run a full project scan across all security categories
Scan History	Access Open Scan History through the Extension Monitoring icon. Confirm what a previous scan actually covered, or reproduce a scan outside the IDE
Log	Access Cortex Cloud Log y through the Extension Monitoring icon. Diagnosing a scan that failed, produced no results, or behaved unexpectedly
Test Connection	Click Test Connection to verify that the extension can reach the Cortex Cloud platform with the configured credentials
Modify Settings	Changing the credentials, the scanner set, the severity threshold, or the excluded paths

When a scan result is unreliable

A scan that reports no issues is not evidence of clean code until the scan itself is confirmed. Work these checks in order — each removes a distinct cause of a deceptively empty result set.

1. Confirm the scope. A single file scan reports issues only for the file that was opened or saved. Click the Play button in the Navigation panel to run a full project scan across all security categories.
2. Confirm the filter. Clear the severity filter in the Navigation panel. A filter set to the highest severity produces an empty tree for a project that carries lower-severity issues.
3. Confirm the severity threshold. Check cortexCloud.severityThreshold in Settings > Extensions > Cortex Cloud. The threshold suppresses issues below a severity floor before they reach the tree, and clearing the panel filter in step 2 does not clear the threshold. Set the threshold to low to rule it out.
4. Confirm the enabled scanners. Check cortexCloud.scanners. A disabled scanner produces an empty category, not an error.
5. Confirm the path is in scope. Check cortexCloud.excludePaths. A glob pattern that matches the directory under review removes the directory from scanning silently.
6. Confirm the suppression hold. A file suppressed within the last two minutes is not rescanned. Wait out the hold period before re-running the scan.
7. Re-run the full project scan and compare the resulting tree against the previous tree.
8. If the re-run produces an identical result, identify the cause.