The Coverage dashboard

The Coverage dashboard is the centralized interface for assessing lineage maturity between code-side assets (VCS repositories, IaC resources) and cloud-side assets (registry artifacts, runtime images, VM instances, cloud resources). The dashboard converts raw lineage data into a per-stage SDLC map and an overall Coverage %.

By default, AppSec practitioners, DevSecOps engineers, and developer users start with the Code-to-Cloud view, which follows assets from source code to deployment and helps identify where code is running and whether lineage is complete. Other users who approach Cortex Cloud from a cloud asset perspective start with the Cloud-to-Code view, which traces runtime assets back to their originating code and ownership.

Prerequisites

Prerequisite	Description
Cortex Cloud license	Application Security entitlements are required to view Code-2-Cloud views; Cortex Cloud Posture Security entitlements are required to view Cloud-2-Code views
Access control	Access to the dashboard and the actions it exposes is governed by the platform's global RBAC layer and by SBAC data scoping. Confirm the exact role permissions for your tenant in the platform RBAC documentation
Data sources onboarded	At least one VCS, one CI/CD, one container registry, and one cloud account data source must be onboarded for the lineage chain to evaluate end-to-end
YOR tagging enabled	Infrastructure lineage requires IaC resources and runtime cloud assets to carry a YOR trace tag. Refer to Workflow 3: Enable infrastructure lineage via YOR tags

Navigate to the dashboard

1. Sign in to the Cortex Cloud console.
2. Navigate to Posture Management → Code-to-Cloud Coverage. The dashboard opens in the Code-2-Cloud view for AppSec roles, or the Cloud-2-Code view for CloudSecOps and other roles.
3. Switch views with the Direction toggle (Code-2-Cloud / Cloud-2-Code) and the Category toggle (Artifact / Infrastructure). The two toggles combine into four dashboard views, each with its own stage order (forward CODE → BUILD → DEPLOY → RUNTIME, or the reverse).

Dashboard layout

• Header region: Direction toggle, Category toggle, application filter, and the Coverage % measurement
• Map region: A per-stage SDLC map, one column per pipeline stage, showing total assets, the Traced/Untraced split, and a per-provider tooltip
• Insights region: Recommended actions that close traceability gaps for the currently scoped view

Coverage percentage (%) calculation

The Coverage % is computed independently per direction/category combination as the proportion of source-side assets with a successful trace to the destination side. Two configuration toggles affect the calculation: Include not-onboarded repositories (changes the denominator) and Reach runtime instead of registry (changes the numerator). NOTE: For the full calculation formulas per view and the toggle behavior, see Reference B: Coverage % calculation and configuration toggles

Filtering and recommended actions

• The dashboard supports a per-view filter set (VCS Organization, Provider, Application Name, Cloud Provider, and others). Applying a filter recalculates the Coverage %, map, and recommendations for the filtered scope
• The Insights region surfaces recommended actions: an insight title, a deep link to the affected assets in the Repositories asset inventory, a bottom-line count, and (where available) a one-click action button that initiates the corresponding onboarding workflow. NOTE: For the complete filter set per view, see Reference C: Dashboard filters by view. For the complete recommended-action catalog by view and stage, see Reference D: Recommended actions by view and stage.

Manage Coverage with the API

Retrieve Code-to-Cloud coverage in automation workflows. See API endpoints for C2C.