> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/visibililty-and-inventory/supply-chain-assets/repository-as-an-asset/manage-repository-assets-through-the-tenant-ui/investigate-repository-assets.md).

# Investigate repository assets

Select a repository row in the table to open its side panel. This provides a consolidated workspace for investigating repository assets and remediating associated security issues without navigating away from the asset inventory.

## Ask the AppSec agentic assistant

From the Repositories table, **right-click a repository** → **Open in Agentic Assistant** → **select Application Security** from the agents menu, and query repository-specific insights (for example, scan coverage, risk posture, or gaps).

Additionally, you can click **Ask AI** in the side panel to access the Agentic agent.

## Explore the repository context and lineage

Navigate through the following tabs in the side panel to review the repository context and lineage. This helps prioritize remediation efforts based on application criticality and assess the potential production impact of vulnerabilities:

{% tabs %}
{% tab title="Overview" %}
Displays the severity breakdown of issues, repository properties, and current scan information.

* **Internet Exposed**: The code in the repository ultimately powers a publicly reachable cloud endpoint, calculated via the Code-to-Cloud graph.
* **Deployed to Runtime**: The repository code is deployed to production runtime environments through CI/CD pipelines.
* **Public**: The repository has public visibility in the VCS provider.
* **Deprecated**: The repository or its components are marked as deprecated.
* **Cases**: X Critical and High Cases when the repository has associated cases with Critical or High severity.
* **Issues**: Shows X Critical and High Issues when the repository has associated issues with Critical or High severity.

For more information about scan management, refer to [Application Security scans management](/application-security/code-security/application-security-scans-management.md).
{% endtab %}

{% tab title="Applications" %}
Displays the business applications associated with the repository, including business criticality ratings and risk scores.

For more information about applications, refer to [Defining Business Applications](/application-security/application-security-posture-management-aspm/applications/defining-business-applications.md).
{% endtab %}

{% tab title="Code to Cloud" %}
Displays the relationship graph from the repository asset to deployed cloud workloads.

Use the graph to perform these supply chain investigations:

* **Trace build paths:** Identify CI/CD pipelines that build repository artifacts. Verify whether pipelines deploy to production.
* **Map cloud infrastructure:** Identify cloud resources provisioned from repository IaC definitions.
* **Assess blast radius:** Trace downstream deployment nodes to understand a vulnerability's production impact.

For more information, refer to [Code to Cloud](/application-security/application-security-posture-management-aspm/code-to-cloud.md).
{% endtab %}
{% endtabs %}

## Investigate and remediate issues by category

The repository side panel organizes issues detected within the repository's underlying assets into dedicated tabs by issue category. Selecting an entry in the repository table opens the issue side card directly within the repository context, allowing you to investigate and remediate the risk without navigating away.

{% tabs %}
{% tab title="Vulnerabilities" %}
**Scanner type:** SCA

Known CVE vulnerabilities in open-source packages declared in dependency manifest files within the repository. Refer to [Software Composition Analysis (SCA) vulnerability issues](/application-security/software-supply-chain-security/risk-and-remediation/software-composition-analysis-sca-scanners/software-composition-analysis-sca-vulnerability-issues.md) for more information.
{% endtab %}

{% tab title="Code Weaknesses" %}
**Scanner type:** SAST

Security weaknesses in first-party source code detected through static analysis. Refer to [Manage code weakness issues](/application-security/application-security-posture-management-aspm/manage-code-weakness-issues.md) for more information.
{% endtab %}

{% tab title="Secrets" %}
**Scanner type:** Secrets

Hardcoded credentials, API keys, tokens, and other sensitive values detected in source code and configuration files. Refer to [Navigate to secrets issues](broken://spaces/8Z0RLJ1BFF5TQL8VtUeK/pages/qK2cWoNaeXpUqeehwmmF) for more information.
{% endtab %}

{% tab title="Package Integrity" %}
**Scanner type:** SCA

Open-source packages with operational risk indicators, such as deprecated or unpopular packages, or license types that violate organizational compliance policies. Refer to [Package operational risk issues](/application-security/code-security/code-security-scanners/software-composition-analysis-sca-scanners/package-operational-risk-scanner/investigate-and-remediate-package-operational-risk-issues.md) for more information.
{% endtab %}

{% tab title="IaC Configuration" %}
**Scanner type:** IaC

Security misconfigurations in Infrastructure-as-Code templates. Refer to [Navigate to IaC misconfiguration issues](broken://spaces/8Z0RLJ1BFF5TQL8VtUeK/pages/Xp3R7VUb7FGxiGkDXVs8) for more information.
{% endtab %}

{% tab title="CI/CD Configuration" %}
**Scanner type:** CI/CD

Security risks and misconfigurations in CI/CD pipeline definitions associated with the repository. Refer to [CI/CD Risks](/application-security/software-supply-chain-security/risk-and-remediation/cicd-risks.md) for more information.
{% endtab %}
{% endtabs %}

## Reference

For detailed information on investigating and remediating issues, refer to [Code Security scanners](/application-security/code-security/code-security-scanners.md).


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/visibililty-and-inventory/supply-chain-assets/repository-as-an-asset/manage-repository-assets-through-the-tenant-ui/investigate-repository-assets.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.