> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/visibililty-and-inventory/supply-chain-assets/repository-as-an-asset/manage-repository-assets-through-the-tenant-ui/reference-repositories-asset-attributes.md). # Reference: Repositories asset attributes This reference lists the attributes of the **Repositories** asset table in the Cortex Cloud unified asset inventory, divided by default column visibility. * **Table 1** lists the attributes displayed as default exposed columns when the table first opens. * **Table 2** lists hidden attributes available through the column picker but not displayed by default. Navigate to the table at **Assets > All Assets > Code > Repositories**. > **Note:** The attribute names in this reference are the labels displayed in the console. The underlying XDM field names are required when you query repository assets through XQL or through the API. The console labels and the XDM field names are not interchangeable. ## Table 1: Attributes displayed by default The following nine attributes are displayed as columns when the **Repositories** table first opens, or after you reset the table to its default state. | Attribute | Description | | ------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Repository Name** | The name of the repository, qualified by its organization or group. The primary identifying column. | | **Repository Organization** | The VCS organization, group, or workspace that contains the repository. | | **Provider** | The VCS platform that hosts the repository, such as `GitHub`, `GitLab`, `GitLab Self-Managed`, `Bitbucket`, or `Azure Repos`. | | **Scanned Branches** | The branches configured for scanning. A repository whose primary branch is absent from this list is being scanned somewhere other than the branch that ships to production. | | **Repository labels** | Labels applied to the repository, drawn from the VCS provider and from platform enrichment. | | **Is repository archived** | Whether the repository is archived in the VCS provider. Displayed as `Yes` or `No`. | | **Business Application Names** | The business applications associated with the repository. This attribute is shared across the platform and is the primary basis for routing work by ownership. | | **First observed** | The timestamp when Cortex Cloud first observed the repository. | | **Observation time** | The timestamp of the most recent observation of the repository. | **The default column set is built for triage, not discovery.** Unlike most asset tables, the default view here leads with operational signal rather than classification: **Scanned Branches** and **Is repository archived** together answer whether a repository is being scanned and whether scanning it still matters, and **Business Application Names** answers who owns the result. Every classification attribute — **Asset Id**, **Asset class**, **Asset category** — is hidden, because those attributes hold the same value on every row of this table and differentiate nothing within it. > **Caution:** **First observed** and **Observation time** both describe when the platform *saw* the repository, not when the repository last *changed* and not when it was last *scanned*. A recent **Observation time** confirms the asset is still being inventoried; it does not confirm that scanners ran or that the code is active. To assess development activity, add **Repository last commit** from Table 2. *** ## Table 2: Attributes available through the column picker The following nineteen attributes are available through the column picker and are not displayed by default. Select the column picker icon to add any of these attributes as a column. #### Asset identity and classification | Attribute | Description | | ----------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- | | **Asset Id** | The unique internal identifier of the repository asset. Required when you call the repository API endpoints, which are keyed by asset identifier. | | **Asset class** | The asset class classification. Always `Code` for a repository. | | **Asset category** | The asset category classification. Always `Repository` for a repository. | | **VCS Organization Asset Id** | The asset identifier of the parent VCS Organization asset. Use this attribute to join repositories to their organization-level posture. | ### Repository properties | Attribute | Description | | --------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Repository primary branch** | The primary branch of the repository, such as `main` or `master`. Compare against **Scanned Branches** to detect scan coverage that misses the shipping branch. | | **Repository size in mb** | The size of the repository in megabytes. | | **Repository Visibility Configuration** | The visibility state of the repository in the VCS provider, such as `Public`, `Private`, or `Internal`. The primary attribute for identifying externally exposed source code. | | **Repository owners** | The owners recorded for the repository in the VCS provider. | | **Repository technologies** | The programming languages and technologies detected in the repository. | ### Repository activity | Attribute | Description | | -------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------ | | **Repository last commit** | The timestamp of the most recent commit. The reliable indicator of whether a repository is actively developed or dormant. | | **Repository tag metadata** | Tag information collected from the repository. | | **Repository issues metadata** | Issue-tracker information collected from the repository in the VCS provider. This attribute describes VCS provider issues, not Cortex Cloud security issues. | | **Repository releases metadata** | Release information collected from the repository. | | **Repository forks** | Fork information for the repository. | ### Context and relationships | Attribute | Description | | ---------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Development Cycle Stages** | The software development lifecycle stages the repository participates in. | | **Applications Ids** | The identifiers of the applications associated with the repository. The identifier counterpart to the **Business Application Names** column shown by default. | | **Attack ID** | The identifier of an attack path associated with the repository. | | **Attack Name** | The name of an attack path associated with the repository. | ### Diagnostic | Attribute | Description | | ------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | **Normalized fields By Source** | The raw normalized field values grouped by the source that supplied them. A diagnostic attribute for tracing where a given value originated when sources disagree. | *** ### Recommended column additions The default view does not carry enough information to prioritize repositories. Add the following columns to convert the inventory into an assessment surface. | Add this column | To answer | | --------------------------------------- | ------------------------------------------------------------------------------------------------ | | **Repository Visibility Configuration** | Which repositories are public, and therefore expose source code and any secrets committed to it? | | **Repository last commit** | Which repositories are actively developed, and which are dormant but not archived? | | **Repository primary branch** | Does scan coverage in **Scanned Branches** actually include the branch that ships? | | **Repository technologies** | Which repositories use technologies that carry known supply chain or ecosystem risk? | | **Repository owners** | Who do I route a finding to when no business application is mapped? | **A high-value combination.** Filter **Repository Visibility Configuration** to `Public`, filter **Is repository archived** to `No`, and sort by **Repository last commit** descending. The result is the set of externally exposed, actively developed repositories — the population where a new finding carries the highest urgency. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/application-security/software-supply-chain-security/visibililty-and-inventory/supply-chain-assets/repository-as-an-asset/manage-repository-assets-through-the-tenant-ui/reference-repositories-asset-attributes.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.