> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/visibililty-and-inventory/package-explorer/tenant-ui-workflow.md). # Tenant (UI) workflow ## How to access the Package Explorer * Navigate to **Modules** > **Supply Chain Security** > **Package Explorer**.\ The Package Explorer includes top-line summary widgets followed by a detailed package table. ## Review the top-line widgets The summary widgets at the top of the page display high-level metrics for the packages in your current scope. Review these widgets for a general summary, then use the table filters below to isolate and investigate specific packages. * **Stage distribution (pie chart):** Shows how packages are distributed across the **Code**, **Deploy**, and **Runtime** stages * **High-Risk Packages:** Counts packages currently classified as high operational risk and breaks the population down by risk level (for example, Low, Medium, High, and N/A). Operational Risk is the primary input to this widget; packages without an Operational Risk value (such as OS packages) are counted as N/A * **Packages Highlights:** Displays packages that are flagged as malicious or deprecated ## Understand the package table Each row describes a specific package and version (for example, `supershell@v1.0.3`). By default, the table is ordered by package **Name**, then by **Version**, and displays a default set of columns. Additional columns are available but hidden by default. * **Default columns:** Name, Version, Package Type (`Application` or `Operating System`), Package Manager, Insights, Used In, and a Vulnerabilities severity bar * **Package Type column:** Indicates whether the row is an `Application` package or an `Operating System (OS)`package. CAS contributes OSS packages only; CWP contributes both OSS and OS packages * **Insights column:** Flags package-level posture signals; **Malicious**, **Deprecated**, or both. Insights are distinct from CVE vulnerabilities * **Vulnerabilities column (severity bar):** Displays CVE issue counts by severity. The counts are links. Selecting a count redirects to the **CAS Vulnerabilities Issues** page, which includes both CAS and CWP vulnerabilities, filtered by the **Package Name** and **Package Version** of the selected row * **Used In column:** Aggregates usage across **Code**, **Deploy**, and **Runtime**, and distinguishes the three stages > NOTE: For the complete list of default and hidden columns, refer to [Reference A: Package table columns](/application-security/software-supply-chain-security/visibililty-and-inventory/package-explorer/references/reference-a-package-table-columns.md). ## Search, filter, and sort the inventory You can search, filter, and sort the table by every field. * Use the column filters to narrow the inventory by any field (for example, Package Type, Package Manager, Operational Risk, or Insights) * To find a package by name or version, enter a search term. Package **Name** and **Version** support both exact and fuzzy matching * To search across a span of versions, enter a version **range** * Select a column header to sort by that column. The default sort is by **Name**, then by **Version** **What happens next:** The table updates to show only the packages that match the active search and filter criteria, reordered by the selected column. ## Inspect a package in the side card Selecting a package row opens a side card dedicated to that package. The side card contains an **Overview** tab and a **Vulnerabilities** tab. 1. Select a package row in the table.\ The package side card opens to the **Overview** tab. 2. Select the **Vulnerabilities** tab to review the package CVE issues, separated into Code, Deployed, and Runtime tables. ### **Overview tab** The **Overview** tab presents the package identity, organizational impact, usage locations, and operational risk, and offers alternative packages. * **Package identity:** The top of the Overview tab shows the **Asset type** (Software Package), the **Asset subtype (code language)** (for example, Python Package), and the **full package name and language icon** (for example, `supershell@v1.0.3`) * **Highlights:** Provides a plain-language summary of the package risk posture (for example, why the package carries High operational risk). The Highlights section also displays the package **Risk** badge and key lifecycle timestamps (First Seen, Last Seen, Last Updated, and Package metadata as of) * **Organizational impact (Used in count):** Shows the overall number of assets, by software development stage, in which the package was found, with a split between **Code** (number of repositories), **Deploy** (number of registry images), and **Runtime** (number of runtime images, VM instances and serverless functions) * **Used In table:** Details the specific locations of the package across the organization and supports filtering on all of its fields. In the **Used In** table, the **Package Type** column represents the **Dependency Type** (for example, direct or transitive) of the package on that asset. Selecting an asset row in the **Used In** table opens the asset side card details in place, without navigating away from the package side card. For the complete list of Used In table columns, refer to [Reference B: Used In table columns](/application-security/software-supply-chain-security/visibililty-and-inventory/package-explorer/references/reference-b-used-in-table-columns.md) * **Operational Risk section:** Displays an overall risk rating (for example, High) and breaks the rating down into Popularity and Maintenance metric groups, each with its own sub-rating.\ NOTE: Operational Risk is populated for Application packages sourced from Application Security only; Operating System packages do not carry Operational Risk ### **Vulnerabilities tab** The **Vulnerabilities** tab presents the CVE issues for the package. The tab organizes the package CVE issues into **three tables** that separate the issues by software development stage: * **Code issues** : CVE issues discovered in source repositories * **Deployed issues**: CVE issues discovered in registry images and other deployed artifacts * **Runtime issues**: CVE issues discovered in VMs, containers, and serverless functions Each table supports standard filtering and ordering on all of its columns and links each CVE back to the affected assets. This separation connects each CVE to its Code-to-Cloud footprint so you can prioritize the vulnerabilities that reach deployed and running workloads.\ NOTE: Vulnerabilities in this tab are CVE issues only; they do not include other finding types or threat-intelligence signals. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/visibililty-and-inventory/package-explorer/tenant-ui-workflow.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.