> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/visibililty-and-inventory/package-explorer.md). # Package Explorer The Package Explorer provides a centralized inventory of all open-source (OSS) and operating-system (OS) packages used across your environment. It aggregates package data into a single view, allowing you to review a package's usage context, operational risk, Insights, vulnerability (CVE) exposure, license information and malware issues without querying individual scanners. **Data sources:** The inventory consolidates packages discovered by two primary systems: * **Cortex Application Security (CAS):** Identifies Application packages * **Cloud Workload Protection (CWP):** Identifies both Application and Operating System packages **Scope and coverage:** The Package Explorer tracks packages across the following lifecycle stages: * **Code:** Source repositories * **Deploy:** Registry images * **Runtime:** Virtual machines (VMs), containers, and serverless functions NOTE: For the package entity attributes and supported ecosystems, see [Reference A: Package table columns](/application-security/software-supply-chain-security/visibililty-and-inventory/package-explorer/references/reference-a-package-table-columns.md). **Core achievements** * **View a unified inventory:** Manage all Application and Operating System packages as single entries across your Code, Deploy, and Runtime environments * **Prioritize by active usage:** Focus remediation efforts on packages that are actively running in your environment, rather than triaging based on the total number of times a package appears * **Tracing Code-to-Cloud footprint:** Map exactly where a package, and its associated vulnerabilities (CVEs), exists in your environment, tracing it from the original source repository to the running workload * **Reduce operational risk:** Expose popularity and maintenance signals so teams choose well-maintained dependencies * **Find safer alternatives:** View AI-generated recommendations for secure alternative packages to replace risky dependencies ## Prerequisites | Prerequisite | Description | | ----------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | **RBAC roles and permissions** | A **Cloud Security** license with permission to view the **Supply Chain Security** module | | **SBAC scope** | Access to the target application scope. The Package Explorer displays packages within the user's assigned application scope. Packages discovered only on assets outside the user's application scope are not displayed. A user scoped to a specific application sees the package inventory and usage counts for that application boundary, not the organization-wide inventory | | **Code data sources** | Source code repositories onboarded as Software Package assets. Required for **Code** usage aggregation | | **Deploy and Runtime data sources** | The Cloud Workload Protection package dataset (registry images, VMs, containers, serverless functions). Required for **Deploy** and **Runtime** usage aggregation | | **Cortex Agentix (optional)** | Cortex Agentix with the AppSec Agent available in the tenant. Required only for the **Show alternatives** action | | **API key (optional)** | A valid Cortex Cloud API key. Required only for programmatic package queries through the read-only Package API | --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/visibililty-and-inventory/package-explorer.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.