> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/visibililty-and-inventory/supply-chain-assets/cicd-pipeline-as-an-asset.md). # CI/CD pipeline as an asset Cortex Cloud Application Security discovers CI/CD pipelines through onboarded repositories and active CI/CD integrations. Each pipeline connects source code with production deployments. The CI/CD pipeline asset provides identity, provider context, build activity, security health, and deployment traceability. ## Prerequisites Before viewing and managing CI/CD pipeline assets, verify the following: | Prerequisite | Description | | --------------------- | ---------------------------------------------------------------------- | | **License** | An active Cortex Cloud license with Application Security entitlements. | | **RBAC role** | The AppSec Admin or SOC Analyst role, or an equivalent custom role. | | **VCS integration** | An active GitHub, GitLab, Bitbucket, or Azure DevOps integration. | | **CI/CD integration** | An active CI/CD integration that supports pipeline discovery. | | **Completed scan** | A completed periodic scan with CI/CD configuration results. | ## Core capabilities and scope * **Discovery and visibility**: Identifies pipeline definitions, providers, instances, repositories, and build activity. * **Security posture**: Aggregates CI/CD configuration risks into a pipeline health profile. * **Deployment lineage**: Connects repositories to images and runtime resources through Code-to-Cloud lineage. * **Scope constraints**: Does not represent individual runs, build logs, scan results, or CI/CD instances. ## Key achievements * **Pipeline discovery and identity:** Every CI/CD pipeline associated with an onboarded repository or CI/CD integration is automatically discovered and registered in the unified asset inventory with a unique asset identifier, pipeline name, CI/CD provider, CI/CD instance, parent repository, and pipeline definition file path. The CI/CD pipeline asset serves as the persistent identity record for the build and deploy workflow * **Build activity tracking:** Each CI/CD pipeline asset carries build activity metadata including the last build execution timestamp and job activity status. The build activity profile enables operational monitoring, identifying active pipelines deploying to production versus dormant pipelines with no recent build activity * **Code to cloud deployment lineage:** The CI/CD pipeline asset is the critical bridge node in the Code to cloud graph, linking the repository (code origin) to deployed runtime assets (container images, VM images, cloud resources). The lineage transforms the pipeline from an isolated workflow definition into a governed deployment component with production impact visibility * **Coverage measurement:** The Command Center tracks the scanning coverage status of your CI/CD pipelines (e.g., Fully covered, Partially covered, or Uncovered). This coverage visibility enables AppSec Managers to identify blind spots in their CI/CD integrations and ensure that pipelines deploying critical workloads are actively monitored for configuration risks * **CI/CD risk detection:** The CI/CD pipeline asset carries a security health profile aggregating CI/CD configuration risk findings from the CI/CD scanner into a severity breakdown — the count of Critical, High, Medium, and Low issues. CI/CD risk findings map to the OWASP CI/CD Top 10 framework, covering categories such as insufficient flow control, inadequate identity and access management, dependency chain abuse, poisoned pipeline execution, and insufficient credential hygiene ## Relationship model The Cortex Cloud platform models the following relationships between the CI/CD pipeline asset and other asset categories to provide full supply chain visibility in the Code-to-Cloud relationship graph. The CI/CD pipeline connects the repository (where code is stored) to deployed runtime assets (where code runs in production). | Related asset category | Inherited metadata and description | | -------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Repository (Parent)** | The repository containing the CI/CD pipeline definition file. The repository asset is the code origin of the pipeline in the Code to cloud graph. The CI/CD pipeline inherits the repository Applications association, Business Criticality, and tags | | **CI/CD instance (Parent)** | The CI/CD platform instance that hosts and executes the pipeline (such as Jenkins server, GitHub Actions organization). The CI/CD Instance asset aggregates security posture across all pipelines within the instance. The CI/CD pipeline inherits the CI/CD Instance provider type and organizational context | | **CI/CD pipeline (Sibling)** | Other CI/CD pipelines defined in the same parent repository or hosted on the same CI/CD instance. Sibling pipelines share the same repository Applications association and tags | | **Container image (Downstream)** | Container images built by the CI/CD pipeline. The Code-to-Cloud graph traces the build lineage from the pipeline to the container image in the registry. The container image inherits the pipeline build context for deployment lineage tracking | | **VM image (Downstream)** | VM images built by the CI/CD pipeline through tools such as Packer, Azure Image Builder and GCP VM Image Builds. The VM image inherits the pipeline build context for deployment lineage tracking | | **Cloud resource (Downstream)** | Cloud resources deployed by the CI/CD pipeline. The Code-to-Cloud graph traces the deployment lineage from the pipeline to the runtime cloud resource. The cloud resource inherits the pipeline deployment context | ## Next steps * [Understand and prioritize CI/CD pipeline assets](/application-security/software-supply-chain-security/visibililty-and-inventory/supply-chain-assets/cicd-pipeline-as-an-asset/understand-and-prioritize-ci-cd-pipeline-assets.md) * [Investigate and manage CI/CD pipeline assets](/application-security/software-supply-chain-security/visibililty-and-inventory/supply-chain-assets/cicd-pipeline-as-an-asset/investigate-and-manage-ci-cd-pipeline-assets.md) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/visibililty-and-inventory/supply-chain-assets/cicd-pipeline-as-an-asset.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.