> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/visibililty-and-inventory/supply-chain-assets.md). # Supply Chain assets Manage software supply chain assets like VCS organizations, code identities, and CI/CD pipelines to gain deep visibility and remediate risks directly. Software supply chain assets are the foundational systems, components, tools, and identities used to construct and deliver your software artifacts. Maintaining a comprehensive inventory of these assets is critical for understanding your environment and securing the SDLC. The supply chain asset inventory includes: * [**Collaborators**](/application-security/software-supply-chain-security/visibililty-and-inventory/supply-chain-assets/vcs-collaborators-as-assets.md): The human and non-human code identities that have access to and interact with your development systems. * [**VCS organizations**](/application-security/software-supply-chain-security/visibililty-and-inventory/supply-chain-assets/vcs-organization-assets.md)**,** [**repositories**](/application-security/software-supply-chain-security/visibililty-and-inventory/supply-chain-assets/repository-as-an-asset.md)**, and** [**technologies**](/application-security/software-supply-chain-security/visibililty-and-inventory/supply-chain-assets/technologies-as-assets.md): The top-level structures within version control platforms and the specific repositories containing your code. This includes technologies used within repositories, such as Python infrastructure and configuration files, including Dockerfiles and Terraform, and package managers, including package.json and go.mod. * [**CI/CD instances**](/application-security/software-supply-chain-security/visibililty-and-inventory/supply-chain-assets/cicd-instance-as-an-asset.md) **and** [**pipelines**](/application-security/software-supply-chain-security/visibililty-and-inventory/supply-chain-assets/cicd-pipeline-as-an-asset.md): The infrastructure and automated workflows that build, test, and deploy your software. * [**Software packages**](/application-security/software-supply-chain-security/visibililty-and-inventory/supply-chain-assets/software-packages-as-assets.md): The open-source dependencies and third-party libraries ingested into your application code. * [**Supply chain tools**](/application-security/software-supply-chain-security/visibililty-and-inventory/supply-chain-assets/tools-as-an-asset.md): The CI/CD pipeline tools and VCS applications integrated into your environment. This inventory provides a centralized location to manage third-party integrations, review usage evidence, and assess risks, including creator and category details. Filter tools by status, such as approved, rejected, or uncategorized, to ensure policy adherence and prioritize remediation. Comprehensive visibility into these assets allows you to accurately map your entire software development environment. Additionally, these inventories display the specific risks identified through supply chain security scans, enabling you to investigate and remediate vulnerabilities, pipeline risks, and misconfigurations directly from the dedicated asset views. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/visibililty-and-inventory/supply-chain-assets.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.