> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/supply-chain-attacks/referenecs/reference-c-attack-catalog-and-data-freshness.md).

# Reference C: Attack catalog and data freshness

This appendix describes the structure of the curated attack catalog and the timing with which a new attack and its exposure data reach the tenant.

## Curated attack catalog

The Supply Chain Attacks page is the curated catalog of notable supply-chain attacks. Attack entries are curated and maintained by Palo Alto Networks and Unit 42; updates propagate to all tenants automatically — there is no customer-facing creation or editing surface. Each attack entry carries an attack name, an attack description, the affected components (compromised OSS packages such as `@qix/color` and compromised supply-chain tools such as `tj-actions/changed-files`), related CVEs (when one has been issued), the primary reference link (Unit 42 prioritized), the discovery date, and the last-updated timestamp.

## Data freshness and timing

A new attack reaches the tenant in **two stages with different timing**. Understanding the distinction prevents the false expectation that exposure for a brand-new attack is calculated instantly.

| Stage                       | What appears                                                                                                                                                                                         | Timing                                                                                                                                                                                                | Mechanism                                                                                                                                                                                                                                                                                                                  |
| --------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **1. Catalog entry**        | The attack entry itself — name, description, affected components, related CVEs, reference link, discovery and last-updated dates                                                                     | **Near-immediate** (typically within seconds of Palo Alto Networks / Unit 42 publishing the entry)                                                                                                    | Delivered through the Cortex Cloud content mechanism. The attack entry does **not** wait for a periodic scan to become visible in the catalog                                                                                                                                                                              |
| **2. Exposure correlation** | The **Impacted assets** counts and the active vs. no-longer-exposed state — which of *your* repositories, CI/CD pipelines, packages, images, runtime assets, findings, and issues the attack touches | Computed on **two triggers**: (a) automatically when a new attack is **added or updated** — a new attack does **not** wait for the next periodic scan; and (b) after each **periodic scan** completes | Computed by the attack enrichment process. On a new-attack trigger, correlation runs against the current asset data; the periodic-scan trigger refreshes correlation against newly scanned asset data, and waits for the most recent CI/CD pipeline enrichment to complete first, so pipeline exposure reflects fresh data |

> NOTE: If no compromised package, tool, CVE, or open issue is present at the time of computation, the sidecar reports **no exposure detected** for that cycle. For the exposure determination logic, see [Reference B: Exposure determination matrix](/application-security/software-supply-chain-security/supply-chain-attacks/referenecs/reference-b-exposure-determination-matrix.md),  


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/supply-chain-attacks/referenecs/reference-c-attack-catalog-and-data-freshness.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.