> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/application-security/code-security/ide/visual-studio-vs-code-and-vs-code-compatible-ides/how-to-use-the-cortex-cloud-extension-in-vs-code.md).

# How to use the Cortex Cloud extension

The Cortex Cloud security extension for VS Code integrates comprehensive scanning, efficient issue management, and remediation capabilities directly into your coding environment, without disturbing development.

## Understand the interface

The Cortex Cloud extension divides the Visual Studio Code workspace into three panes. Each stage of the workflow is performed in a specific pane, and the panes are referenced by name throughout this guide.

Select the Cortex Cloud icon in the extension panel to open the extension.

| Pane                 | Position | Function                                                                                                                                                                                                                                                      |
| -------------------- | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Navigation panel** | Left     | Displays a tree structure of issues by security category: **IaC misconfigurations**, **Secrets**, **Vulnerabilities (SCA)**, **Licenses and Package Operational Risk**. Expand a category to reveal the folders containing the issues detected during a scan. |
| **Code editor**      | Middle   | Displays the codebase, the issues related to resources (for IaC misconfigurations) or files, and the remediation options.                                                                                                                                     |
| **Problems Tool**    | Right    | Displays detailed information about a selected issue, including code differences when available, and remediation options.                                                                                                                                     |

## Workflow

```mermaid
flowchart LR
    A[Scan: produce a result set] --> B[Understand: read the issue distribution]
    B --> C[Prioritize: build the work queue]
    C --> D[Investigate: establish the code context]
    D --> E[Remediate: fix, suppress, or consult documentation]
```

| Stage           | Decision                                                          | Primary surface                                      |
| --------------- | ----------------------------------------------------------------- | ---------------------------------------------------- |
| **Scan**        | Whether to analyze the whole project or a single file             | **Play** button in the **Navigation panel**          |
| **Understand**  | Which security categories carry issues, and where the issues live | Category tree in the **Navigation panel**            |
| **Prioritize**  | Which issue to work on next                                       | Filter icon in the **Navigation panel**              |
| **Investigate** | What the issue is and where the issue lives in the code           | **Problems Tool** and the **Code editor**            |
| **Remediate**   | Whether to fix, suppress, or consult documentation                | **Fix**, **Suppress**, and **Documentation** actions |

### Scan

Scan your code for security issues using two primary methods: full project scans and single file scans. Select the method by the size of the change under review.

| Method                | Trigger                                                                         | Use when                                                                                                                                                    |
| --------------------- | ------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Full project scan** | Click the **Play** button for any security category in the **Navigation panel** | Establishing or re-establishing the baseline issue set — at the start of a working session, or after a broad change such as a dependency upgrade or a merge |
| **Single file scan**  | Triggered automatically when you open or save that file                         | Validating a focused edit without re-analyzing the entire project                                                                                           |

> **Important:** The **Play** button initiates scans across all security categories, not only the category the **Play** button belongs to. Clicking **Play** on the **Secrets** category produces a complete result set covering IaC misconfigurations, Secrets, Vulnerabilities (SCA), and Licenses.

**Confirm the scan covered what you intended.** The **Navigation panel** tree does not distinguish a full project result set from a single file result set. A tree populated by a save-triggered single file scan looks the same as a tree populated by a full project scan. Before treating the tree as a project-wide baseline, click **Play** and allow the scan to complete.

### Understand the results

The **Navigation panel** displays a tree structure of issues according to security category: **IaC misconfigurations**, **Secrets**, **Vulnerabilities (SCA)**, and **Licenses**. Read the tree before selecting any individual issue — the category structure describes the distribution of the result set and determines where to commit attention.

* Expand a security category to reveal the folders containing the specific issues detected during a scan.
* Issues are grouped by security category, which makes the categories the primary browsing axis.
* Click a category or a folder to view the associated issues.

**Confirm the scope of the result set.** A single file scan reports issues only for the file that was opened or saved. Before treating the tree as a project-wide baseline, click the **Play** button in the **Navigation panel** to run a full project scan across all categories.

> **Important:** An empty category is not proof that the category is clean. A scanner disabled in `cortexCloud.scanners`, a path excluded by `cortexCloud.excludePaths`, or a severity floor set in `cortexCloud.severityThreshold` each removes issues from the tree without any indication in the tree itself. See When a scan result is unreliable before concluding that a category carries no risk.

### Prioritize

Prioritize and address the most critical issues by filtering the scan results based on category and severity. Apply both — the category narrows the result set to a single risk class, and severity establishes the order of risk within that class.

| Filter                | Control                                   | Use when                                                                            |
| --------------------- | ----------------------------------------- | ----------------------------------------------------------------------------------- |
| **Security category** | Category node in the **Navigation panel** | Isolating a single risk class, such as clearing all Secrets issues before a commit. |
| **Severity level**    | Filter icon in the **Navigation panel**   | Ordering the queue by risk. Start at the highest severity and work down.            |

> **Caution:** The severity filter in the **Navigation panel** and the `cortexCloud.severityThreshold` setting are two separate controls. The filter changes what the tree displays. The threshold suppresses issues below a severity floor before they reach the tree. Clearing the filter does not clear the threshold.

**Sequence the queue.** Filter to the highest severity first. Within that severity, open each issue and check the **Problems Tool** for a suggested fix — IaC misconfigurations and SCA CVE vulnerabilities carry automated fixes, while Secrets and License issues do not. Clear the issues that carry a fix, then work the remainder, which require a manual decision: suppression or policy-guided mitigation. Lower the severity filter one tier and repeat.

**Order within a severity tier by issue evidence.** Severity alone does not separate two issues of the same rank. Use the evidence the scanner attaches to each issue — a validated-active secret outranks an unvalidated one, and a CVE with an available fix version outranks one without. For the evidence fields each scanner produces, see Issue categories.

> **Note:** Severity is a static classification. When Visual Studio Code scan results are uploaded to the Cortex Cloud platform, the Urgency engine supersedes severity by combining it with Code-to-Cloud deployment context, exploit intelligence, and business criticality. Urgency is computed server-side and is not available in the IDE — use severity and issue evidence for local sequencing, and Urgency for platform-level prioritization.

### Investigate

An issue count tells you that risk exists. Investigation establishes what the issue is and where the issue lives in the code, which determines the remediation path.

**Open the issue.**

1. Under a security category in the **Navigation panel**, expand the folders to locate the issues.
2. (Optional) Use the filter icon in the **Navigation panel** to refine the issues by severity.
3. Select an individual issue to display the issue details in the **Code editor** and the **Problems Tool**.

**Read the issue in the Code editor.** The extension highlights secrets, misconfigurations, vulnerabilities, and license non-compliance issues with red marks next to the affected lines.

* Hover over a red mark to view the issue details, severity, and remediation options.
* For multiple issues at the same location, scroll to view all detected issues.
* Click **Console** to open the **Problems Tool** and explore further information about the detected issue.

**Read the issue in the Problems Tool.** The **Problems Tool** provides a detailed view of the selected issue, including the code differences when available and the remediation options. Open the **Problems Tool** by selecting an issue in the **Navigation panel**, or through the **Console** option in the **Code editor**.

> **Important:** For an IaC resource carrying several misconfigurations, the hovered list at the affected line determines the remediation effort. A single configuration block carrying several misconfigurations is one edit against several issues — scroll the full hovered list before applying any fix.

### Remediate

Mitigate issues directly through both the **Code editor** and the **Problems Tool**. Options include **Fix**, **Suppress**, and **Documentation**.

| Path              | Use when                                                                                                       |
| ----------------- | -------------------------------------------------------------------------------------------------------------- |
| **Fix**           | A suggested fix is displayed for the issue. The fastest path — the fix is applied to the code on selection.    |
| **Suppress**      | No fix is available, or the issue is not the current priority, and the issue is an accepted risk for the file. |
| **Documentation** | No automated fix is available and the mitigation approach is unclear.                                          |

> **Note:** Not all remediation options are available for all issues.

#### Apply a fix

When selecting an issue in either the **Code editor** or the **Problems Tool**, a suggested fix is displayed when available. Fixes are applied automatically upon selection.

> **Caution:** Selecting a suggested fix modifies your source file. Review the code difference displayed in the **Problems Tool** before selecting the fix, and confirm the resulting change against version control before committing. This applies with particular force to an SCA fix, which changes a dependency version in your package manifest.

| Issue category              | Fix behavior                                                                                                                                            |
| --------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **IaC misconfigurations**   | The fix modifies the configuration. The **Problems Tool** displays the code difference to be fixed.                                                     |
| **SCA CVE vulnerabilities** | The fix bumps the package version. Fix the specific vulnerability detected during the scan by upgrading the package to the version that includes a fix. |
| **Secrets issues**          | No automated fix. Follow the policy guidelines. For rotation guidance, see Secrets issues.                                                              |
| **License mis-compliance**  | No automated fix. Follow the policy guidelines. For handling guidance, see License compliance issues.                                                   |

#### Suppress an issue

Suppress an issue to temporarily hide or ignore an issue without fixing it, allowing you to concentrate on more important issues. The suppression is scoped to the file.

1. Select an issue from the **Navigation panel** → click **Suppress** in either the **Code editor** or the **Problems Tool**.
2. Provide a justification for the suppression → press **Enter** to confirm.

The justification will be added as a commented annotation to your source code. Write the justification for a reviewer, not for yourself — the annotation is committed with the code and is the only record of the risk-acceptance decision.

> **Warning:** A suppression created in Visual Studio Code is not local to the IDE. The committed annotation is recognized by every scanning stage — the Cortex CLI, CI/CD scans, and periodic platform scans all honor the suppression. Suppressing an issue in the IDE silences that issue across the entire lifecycle, so treat the decision as organizational risk acceptance rather than a local display preference.

> **Caution:** After suppressing an issue, the file will not be scanned for two minutes. This is to prevent the issue from being re-triggered. Saving the file during the hold period will not trigger a scan. Wait out the hold period before treating a subsequent clean save as verification.

For information on developer suppression refer to [Developer suppressions](/application-security/code-security/developer-suppressions.md).

#### Consult the documentation

If automated fixes are not available, policy documentation can provide guidance on how to address the issue. Select an issue → click **Documentation** in either the **Code editor** or the **Problems Tool**. You are redirected to the relevant policy documentation, which includes suggested guidelines on how to solve the issue.

## Extension actions

Find extension actions under the **Cortex Cloud** section of the **Navigation** panel. Every action operates on the extension as a whole, not on an individual issue.

| Action              | Use when                                                                                                                                                   |
| ------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Play**            | Run a full project scan across all security categories                                                                                                     |
| **Scan History**    | Access **Open Scan History** through the **Extension Monitoring** icon. Confirm what a previous scan actually covered, or reproduce a scan outside the IDE |
| **Log**             | Access **Cortex Cloud Log y** through the **Extension Monitoring** icon. Diagnosing a scan that failed, produced no results, or behaved unexpectedly       |
| **Test Connection** | Click **Test Connection** to verify that the extension can reach the Cortex Cloud platform with the configured credentials                                 |
| **Modify Settings** | Changing the credentials, the scanner set, the severity threshold, or the excluded paths                                                                   |

## When a scan result is unreliable

A scan that reports no issues is not evidence of clean code until the scan itself is confirmed. Work these checks in order — each removes a distinct cause of a deceptively empty result set.

1. Confirm the scope. A single file scan reports issues only for the file that was opened or saved. Click the **Play** button in the **Navigation panel** to run a full project scan across all security categories.
2. Confirm the filter. Clear the severity filter in the **Navigation panel**. A filter set to the highest severity produces an empty tree for a project that carries lower-severity issues.
3. Confirm the severity threshold. Check `cortexCloud.severityThreshold` in **Settings > Extensions > Cortex Cloud**. The threshold suppresses issues below a severity floor before they reach the tree, and clearing the panel filter in step 2 does not clear the threshold. Set the threshold to `low` to rule it out.
4. Confirm the enabled scanners. Check `cortexCloud.scanners`. A disabled scanner produces an empty category, not an error.
5. Confirm the path is in scope. Check `cortexCloud.excludePaths`. A glob pattern that matches the directory under review removes the directory from scanning silently.
6. Confirm the suppression hold. A file suppressed within the last two minutes is not rescanned. Wait out the hold period before re-running the scan.
7. Re-run the full project scan and compare the resulting tree against the previous tree.
8. If the re-run produces an identical result, identify the cause.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/application-security/code-security/ide/visual-studio-vs-code-and-vs-code-compatible-ides/how-to-use-the-cortex-cloud-extension-in-vs-code.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.