> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/visibililty-and-inventory/artifact-trust-score/tenant-ui-workflow.md).
# Tenant (UI) workflow
The Trust Score is view-only in the Cortex Cloud tenant. It has no API, CLI, IDE, or Terraform workflow.
## Navigate to an artifact and view the Trust Score
View the Trust Score from the artifact side card.
1. Navigate to **Inventory > All Assets**.
2. Under the **Compute** section, select a category: **Container Images**, **Container instances**, **VM Instances**, or **VM Images**.
3. Select an artifact from the resulting table whose Trust Score you want to review.
4. In the artifact side card, under the **Properties** section, locate the artifact **Trust Score**.
**NOTE**: If the artifact has a complete Code-to-Cloud lineage, the **Properties** section shows the current Trust Score. If the artifact lacks a complete lineage, the Trust Score displays as **Not Calculated**.
## Review the Trust Score evidence
The Trust Score evidence explains why an artifact received its score. It lists every rule and SBOM finding evaluated for the artifact, sorted by Finding Contribution so the findings that lowered the score the most appear first.
1. In the artifact side card, select the **Trust Score**.\
You are redirected to the Code to Cloud tab displaying the artifact's Trust Score and Trust Level, and an evidence or findings table.
2. Review the evidence table.\
Each row is one rule or SBOM finding evaluated for the artifact, with details as displayed in the columns described below. Each finding has a Finding Contribution, that is the amount by which the total Trust Score would potentially rise if you resolved that finding. The table lists findings by Finding Contribution, highest first, so the findings that offer the greatest trust recovery appear at the top.
The evidence table includes the following columns:
| Column | Description |
| ------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Finding Type** | The source of the finding: Values:
- Environment: A CI/CD supply chain check
- SBOM: A third-party package risk
|
| **Category** | The Supply Chain Security category of the finding (such as Vulnerability). For category details, refer to [Reference B: Supply Chain Security Category values](/application-security/software-supply-chain-security/visibililty-and-inventory/artifact-trust-score/references/reference-b-supply-chain-security-category-values.md) |
| **Finding Name** | The name of the finding |
| **Finding (Rule)-Id** | The identifier of the finding or the rule that generated the finding |
| **Finding Severity** | The severity of the finding, defined by its detection rule: Critical, High, Medium, Low, or Info |
| **Affected Asset** | The asset the finding applies to. For an SBOM finding, the third-party package; for an Environment finding, the supply chain asset (for example, the VCS repository, CI/CD pipeline, or instance) evaluated in the artifact's Code-to-Cloud path |
| **Updated at** | The date and time the finding was last updated. For example, when its status changed or it was re-evaluated during a Trust Score recalculation |
| **Finding Contribution** | The percentage by which the finding potentially lowers the artifact Trust Score if mitigated |
## Prioritize remediation by Trust Score Contribution
Use the Trust Score Contribution to determine which supply chain findings to address first. Because this metric measures exactly how much an open finding lowers an artifact's Trust Score, you should prioritize remediating high-contribution findings—such as critical vulnerabilities or high-severity failed CI/CD checks—to achieve the largest immediate trust recovery. Once those primary issues are resolved, you can schedule lower-contribution findings for routine remediation, addressing them later or in batches based on their Supply Chain Security Category.
## Remediate a finding
1. In the Trust Score evidence table: Select the column options control > enable the **Finding ID** column. \
The **Finding ID** column displays a unique identifier for each finding row.
2. Identify the highest-contribution finding at the top of the table. Copy its **Finding ID** value.
3. Navigate to **Cases & Issues > Issues**.
4. Select the **Findings** tab.
5. Filter the Findings table by **ID** equal to the **Finding ID** you copied from the Trust Score evidence table.
6. Select the matching finding row. \
The finding side card opens, showing the finding details.
7. Review the finding's general remediation guidance and its contributing risk factors, then apply the recommended fix.
**Results**
After you resolve the finding, Cortex Cloud raises the artifact's Trust Score by that finding's contribution on the next Trust Score recalculation. Repeat this procedure for the next highest-contribution finding to recover the most trust first.
> NOTE: The Trust Score recalculates periodically. The recovered Trust Score appears after the next recalculation, not immediately after you resolve the finding.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/visibililty-and-inventory/artifact-trust-score/tenant-ui-workflow.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.