Package Explorer

The Package Explorer provides a centralized inventory of all open-source (OSS) and operating-system (OS) packages used across your environment. It aggregates package data into a single view, allowing you to review a package's usage context, operational risk, Insights, vulnerability (CVE) exposure, license information and malware issues without querying individual scanners.

Data sources: The inventory consolidates packages discovered by two primary systems:

• Cortex Application Security (CAS): Identifies Application packages
• Cloud Workload Protection (CWP): Identifies both Application and Operating System packages

Scope and coverage: The Package Explorer tracks packages across the following lifecycle stages:

• Code: Source repositories
• Deploy: Registry images
• Runtime: Virtual machines (VMs), containers, and serverless functions

NOTE: For the package entity attributes and supported ecosystems, see Reference A: Package table columns.

Core achievements

• View a unified inventory: Manage all Application and Operating System packages as single entries across your Code, Deploy, and Runtime environments
• Prioritize by active usage: Focus remediation efforts on packages that are actively running in your environment, rather than triaging based on the total number of times a package appears
• Tracing Code-to-Cloud footprint: Map exactly where a package, and its associated vulnerabilities (CVEs), exists in your environment, tracing it from the original source repository to the running workload
• Reduce operational risk: Expose popularity and maintenance signals so teams choose well-maintained dependencies
• Find safer alternatives: View AI-generated recommendations for secure alternative packages to replace risky dependencies

Prerequisites

Prerequisite	Description
RBAC roles and permissions	A Cloud Security license with permission to view the Supply Chain Security module
SBAC scope	Access to the target application scope. The Package Explorer displays packages within the user's assigned application scope. Packages discovered only on assets outside the user's application scope are not displayed. A user scoped to a specific application sees the package inventory and usage counts for that application boundary, not the organization-wide inventory
Code data sources	Source code repositories onboarded as Software Package assets. Required for Code usage aggregation
Deploy and Runtime data sources	The Cloud Workload Protection package dataset (registry images, VMs, containers, serverless functions). Required for Deploy and Runtime usage aggregation
Cortex Agentix (optional)	Cortex Agentix with the AppSec Agent available in the tenant. Required only for the Show alternatives action
API key (optional)	A valid Cortex Cloud API key. Required only for programmatic package queries through the read-only Package API