> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/visibililty-and-inventory/supply-chain-assets.md). # Supply Chain assets Software supply chain assets are the foundational systems, components, tools, and identities used to construct and deliver your software artifacts. Maintaining a comprehensive inventory of these assets is critical for understanding your environment and securing the SDLC. The supply chain asset inventory includes: * [**Collaborators**](/application-security/software-supply-chain-security/visibililty-and-inventory/supply-chain-assets/vcs-collaborators-as-assets.md): The human and non-human code identities that have access to and interact with your development systems. * [**VCS organizations**](/application-security/software-supply-chain-security/visibililty-and-inventory/supply-chain-assets/vcs-organization-assets.md)**,** [**repositories**](/application-security/software-supply-chain-security/visibililty-and-inventory/supply-chain-assets/repository-as-an-asset.md)**, and** [**technologies**](/application-security/software-supply-chain-security/visibililty-and-inventory/supply-chain-assets/technologies-as-assets.md): The top-level structures within version control platforms and the specific repositories containing your code. This includes technologies used within repositories, such as Python infrastructure and configuration files, including Dockerfiles and Terraform, and package managers, including package.json and go.mod. * [**CI/CD instances**](/application-security/software-supply-chain-security/visibililty-and-inventory/supply-chain-assets/cicd-instance-as-an-asset.md) **and** [**pipelines**](/application-security/software-supply-chain-security/visibililty-and-inventory/supply-chain-assets/cicd-pipeline-as-an-asset.md): The infrastructure and automated workflows that build, test, and deploy your software. * [**Software packages**](/application-security/software-supply-chain-security/visibililty-and-inventory/supply-chain-assets/software-packages-as-assets.md): The open-source dependencies and third-party libraries ingested into your application code. * [**Supply chain tools**](/application-security/software-supply-chain-security/visibililty-and-inventory/supply-chain-assets/tools-as-an-asset.md): The CI/CD pipeline tools and VCS applications integrated into your environment. This inventory provides a centralized location to manage third-party integrations, review usage evidence, and assess risks, including creator and category details. Filter tools by status, such as approved, rejected, or uncategorized, to ensure policy adherence and prioritize remediation. Comprehensive visibility into these assets allows you to accurately map your entire software development environment. Additionally, these inventories display the specific risks identified through supply chain security scans, enabling you to investigate and remediate vulnerabilities, pipeline risks, and misconfigurations directly from the dedicated asset views. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/visibililty-and-inventory/supply-chain-assets.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.