Reference C: Attack catalog and data freshness

This appendix describes the structure of the curated attack catalog and the timing with which a new attack and its exposure data reach the tenant.

Curated attack catalog

The Supply Chain Attacks page is the curated catalog of notable supply-chain attacks. Attack entries are curated and maintained by Palo Alto Networks and Unit 42; updates propagate to all tenants automatically — there is no customer-facing creation or editing surface. Each attack entry carries an attack name, an attack description, the affected components (compromised OSS packages such as @qix/color and compromised supply-chain tools such as tj-actions/changed-files), related CVEs (when one has been issued), the primary reference link (Unit 42 prioritized), the discovery date, and the last-updated timestamp.

Data freshness and timing

A new attack reaches the tenant in two stages with different timing. Understanding the distinction prevents the false expectation that exposure for a brand-new attack is calculated instantly.

Stage	What appears	Timing	Mechanism
1. Catalog entry	The attack entry itself — name, description, affected components, related CVEs, reference link, discovery and last-updated dates	Near-immediate (typically within seconds of Palo Alto Networks / Unit 42 publishing the entry)	Delivered through the Cortex Cloud content mechanism. The attack entry does not wait for a periodic scan to become visible in the catalog
2. Exposure correlation	The Impacted assets counts and the active vs. no-longer-exposed state — which of your repositories, CI/CD pipelines, packages, images, runtime assets, findings, and issues the attack touches	Computed on two triggers: (a) automatically when a new attack is added or updated — a new attack does not wait for the next periodic scan; and (b) after each periodic scan completes	Computed by the attack enrichment process. On a new-attack trigger, correlation runs against the current asset data; the periodic-scan trigger refreshes correlation against newly scanned asset data, and waits for the most recent CI/CD pipeline enrichment to complete first, so pipeline exposure reflects fresh data

NOTE: If no compromised package, tool, CVE, or open issue is present at the time of computation, the sidecar reports no exposure detected for that cycle. For the exposure determination logic, see Reference B: Exposure determination matrix,