> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/visibililty-and-inventory/supply-chain-assets/repository-as-an-asset/manage-repository-assets-through-the-tenant-ui.md). # Manage repository assets through the tenant (UI) ## **Prerequisites** Before viewing and managing repository assets, verify the following: | Prerequisite | Description | | ------------------------- | ------------------------------------------------------------------------------------------------------------------------ | | **License** | An active Cortex Cloud license with Application Security entitlements | | **RBAC role** | The AppSec Admin or SOC Analyst role, or an equivalent custom role with asset inventory and issue management permissions | | **VCS integration** | At least one Version Control System (GitHub, GitLab, Bitbucket, Azure DevOps) integrated and active | | **Repository onboarding** | At least one repository onboarded through the VCS integration and visible in the asset inventory | ## Understand repository assets To access repository assets, under **Inventory**, select **All Assets** → **Code** → **Repositories**. The **Repositories** assets page includes a dashboard and an inventory. ### Repository dashboard The dashboard includes two widgets: * **Providers**: Displays connected version control providers (such as GitHub and GitLab) and the number of repositories found in each provider * **Visibilitiy Configuration (privacy state)**: Shows the distribution between public and private repositories and the amount of repositories in each category Selecting an item in either widget filters the table accordingly. ### Repository asset inventory The inventory table displays repository attributes as columns. A default set is exposed, while additional attributes are hidden. Select **Menu Settings** to add them. See [Reference: Repositories asset attributes](/application-security/software-supply-chain-security/visibililty-and-inventory/supply-chain-assets/repository-as-an-asset/manage-repository-assets-through-the-tenant-ui/reference-repositories-asset-attributes.md) for details about each attribute. ## Repository actions After reviewing the repository's health, you can perform the following operations from the **Actions** menu in the side panel. * **Rescan a repository:** Click **Rescan** to trigger an on-demand scan using the currently configured scanners * **Export an SBOM:** Click **Export SBOM** to generate and download a Software Bill of Materials. * **Level**: Select **Repository** to download the SBOM for the selected repository, or **Organization** to download all SBOM reports for the parent organization as a ZIP archive * **Supported formats** * `CycloneDX` v1.4: XML or JSON * `CycloneDX` v1.5: XML or JSON * `CycloneDX` v1.6: XML or JSON * `SDPX` v2.3: JSON or TXT * **Open in GitHub:** Click **Open in GitHub** to pivot directly to the native repository environment to investigate source code, review commit history, or initiate remediation through a pull request * **View asset data:** Click View asset data to view raw repository data in `JSON` (default) or tree view ## Filter and prioritize repositories The Repositories page displays a table of all repositories. Use the search bar to find repositories by name, or apply filters to narrow results based on operational and security metadata. ### High-priority filtering workflows To effectively reduce the organization risk surface, apply the following filter combinations to prioritize remediation efforts: * **Target critical assets:** Filter by **Business Application Names** to isolate repositories tied to essential services and prioritize their vulnerabilities for remediation * **Identify public exposure risks:** Filter by **Repository visibility configuration: Public** to identify proprietary repositories inadvertently set to public in the VCS provider * **Find active repositories missing scanner coverage:** Filter by **Is repository archived: No** and sort the table by the **Last Scan Date** column to highlight actively maintained repositories that have never been scanned * **Filter out noise from stale code:** Filter by **Is repository archived: Yes** or sort by the oldest **Last Commit Date** to isolate abandoned or read-only codebases * **Scope by business unit or environment:** Use the **repository tag metadata** filter to isolate the inventory for specific engineering teams or deployment environments ## Next steps [Investigate repository assets](/application-security/software-supply-chain-security/visibililty-and-inventory/supply-chain-assets/repository-as-an-asset/manage-repository-assets-through-the-tenant-ui/investigate-repository-assets.md) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/visibililty-and-inventory/supply-chain-assets/repository-as-an-asset/manage-repository-assets-through-the-tenant-ui.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.